Skip to content

Commit 745d009

Browse files
samuel40791765samuel40791765
authored
Route ML-DSA ACVP to the right APIs (#2884)
### Description of changes: The previous ML-DSA change weren't routing against the right APIs. This fixes that. Issues were mainly: 1. `extmu` is exclusive to `signatureInterface=internal`, but we were passing in false for `signatureInterface=external`. 2. `ml_dsa_*_sign` APIs are non-deterministic and we weren't passing in `rnd` as the random bytes. This routes the SignGen tests to the right places. ### Call-outs: N/A ### Testing: New ACVP demo vector, verified against expected outputs and added to this change. The new tests fail without the new changes made to ACVP. By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.
1 parent 7c02cb3 commit 745d009

File tree

4 files changed

+39
-26
lines changed

4 files changed

+39
-26
lines changed

‎util/fipstools/acvp/acvptool/subprocess/ml_dsa.go‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ type mlDsaSigGenTestGroup struct {
100100
ParameterSet string `json:"parameterSet"`
101101
Deterministic bool `json:"deterministic"`
102102
SignatureInterface string `json:"signatureInterface"`
103-
ExternalMu bool `json:"externalMu`
103+
ExternalMu *bool `json:"externalMu`
104104
Tests []struct {
105105
ID uint64 `json:"tcId"`
106106
Message hexEncodedByteString `json:"message"`
@@ -123,8 +123,11 @@ type mlDsaSigGenTestCaseResponse struct {
123123
}
124124

125125
// Convert boolean to byte slice (using 1 for true, 0 for false)
126-
func boolToBytes(b bool) []byte {
127-
if b {
126+
func boolToBytes(b *bool) []byte {
127+
if b == nil {
128+
return nil // Field doesn't exist
129+
}
130+
if *b {
128131
return []byte{1}
129132
}
130133
return []byte{0}
@@ -174,7 +177,7 @@ type mlDsaSigVerTestGroup struct {
174177
ParameterSet string `json:"parameterSet"`
175178
Deterministic bool `json:"deterministic"`
176179
SignatureInterface string `json:"signatureInterface"`
177-
ExternalMu bool `json:"externalMu`
180+
ExternalMu *bool `json:"externalMu`
178181
Tests []struct {
179182
ID uint64 `json:"tcId"`
180183
PK hexEncodedByteString `json:"pk"`

‎util/fipstools/acvp/acvptool/test/expected/ML-DSA.bz2‎

959 KB
Binary file not shown.

‎util/fipstools/acvp/acvptool/test/vectors/ML-DSA.bz2‎

1.31 MB
Binary file not shown.

‎util/fipstools/acvp/modulewrapper/modulewrapper.cc‎

Lines changed: 32 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3380,31 +3380,29 @@ static bool ML_DSA_SIGGEN(const Span<const uint8_t> args[],
33803380
const Span<const uint8_t> context = args[4];
33813381
const Span<const uint8_t> extmu = args[5];
33823382

3383-
using SignFunc = int (*)(const uint8_t*, uint8_t*, size_t*,
3384-
const uint8_t*, size_t, const uint8_t*, size_t);
33853383
using SignInternalFunc = int (*)(const uint8_t*, uint8_t*, size_t*,
33863384
const uint8_t*, size_t,
33873385
const uint8_t*, size_t, const uint8_t*);
33883386

33893387
// Group all related functions for each variant
33903388
struct MLDSA_functions {
33913389
void (*params_init)(ml_dsa_params*);
3392-
SignFunc sign;
33933390
SignInternalFunc sign_internal;
33943391
SignInternalFunc extmu_sign_internal;
33953392
};
33963393

3397-
// Select function set based on NID
3394+
// Select function set based on NID. We must use |ml_dsa_*_sign_internal| here,
3395+
// to account for the random inputs (rnd).
33983396
MLDSA_functions mldsa_funcs;
33993397
if (nid == NID_MLDSA44) {
3400-
mldsa_funcs = {ml_dsa_44_params_init, ml_dsa_44_sign,
3401-
ml_dsa_44_sign_internal, ml_dsa_extmu_44_sign_internal};
3398+
mldsa_funcs = {ml_dsa_44_params_init, ml_dsa_44_sign_internal,
3399+
ml_dsa_extmu_44_sign_internal};
34023400
} else if (nid == NID_MLDSA65) {
3403-
mldsa_funcs = {ml_dsa_65_params_init, ml_dsa_65_sign,
3404-
ml_dsa_65_sign_internal, ml_dsa_extmu_65_sign_internal};
3401+
mldsa_funcs = {ml_dsa_65_params_init, ml_dsa_65_sign_internal,
3402+
ml_dsa_extmu_65_sign_internal};
34053403
} else if (nid == NID_MLDSA87) {
3406-
mldsa_funcs = {ml_dsa_87_params_init, ml_dsa_87_sign,
3407-
ml_dsa_87_sign_internal, ml_dsa_extmu_87_sign_internal};
3404+
mldsa_funcs = {ml_dsa_87_params_init, ml_dsa_87_sign_internal,
3405+
ml_dsa_extmu_87_sign_internal};
34083406
} else {
34093407
return false;
34103408
}
@@ -3415,12 +3413,8 @@ static bool ML_DSA_SIGGEN(const Span<const uint8_t> args[],
34153413
size_t signature_len = params.bytes;
34163414
std::vector<uint8_t> signature(signature_len);
34173415

3418-
if (!context.empty()) {
3419-
if (!mldsa_funcs.sign(sk.data(), signature.data(), &signature_len,
3420-
msg.data(), msg.size(), context.data(), context.size())) {
3421-
return false;
3422-
}
3423-
} else {
3416+
if (!extmu.empty()) {
3417+
// Only signatureInterface: internal contains the externalMu field.
34243418
if (extmu.data()[0] == 0) {
34253419
// generate the signatures raw sign mode
34263420
if (!mldsa_funcs.sign_internal(sk.data(), signature.data(), &signature_len,
@@ -3434,6 +3428,20 @@ static bool ML_DSA_SIGGEN(const Span<const uint8_t> args[],
34343428
return false;
34353429
}
34363430
}
3431+
} else {
3432+
// |context| is unique to signatureInterface: external.
3433+
//
3434+
// Prepare |pre| exactly how |ml_dsa_sign| is doing. The maximum |context| size
3435+
// for ML-DSA is 255 bytes. We append a 0 and the size as two additional bytes
3436+
// before |context| to become the prefix string.
3437+
uint8_t pre[257];
3438+
pre[0] = 0;
3439+
pre[1] = context.size();
3440+
OPENSSL_memcpy(pre + 2 , context.data(), context.size());
3441+
if (!mldsa_funcs.sign_internal(sk.data(), signature.data(), &signature_len,
3442+
msg.data(), msg.size(), pre, 2 + context.size(), rnd.data())) {
3443+
return false;
3444+
}
34373445
}
34383446

34393447
return write_reply({Span<const uint8_t>(signature)});
@@ -3476,12 +3484,8 @@ static bool ML_DSA_SIGVER(const Span<const uint8_t> args[], ReplyCallback write_
34763484
}
34773485

34783486
uint8_t reply[1] = {0};
3479-
if (!context.empty()) {
3480-
if (mldsa_funcs.verify(pk.data(), sig.data(), sig.size(), msg.data(),
3481-
msg.size(), context.data(), context.size())) {
3482-
reply[0] = 1;
3483-
}
3484-
} else {
3487+
if (!extmu.empty()) {
3488+
// Only signatureInterface: internal contains the externalMu field.
34853489
if (extmu.data()[0] == 0) {
34863490
// verify the signatures raw sign mode
34873491
if (mldsa_funcs.verify_internal(pk.data(), sig.data(), sig.size(), msg.data(),
@@ -3495,6 +3499,12 @@ static bool ML_DSA_SIGVER(const Span<const uint8_t> args[], ReplyCallback write_
34953499
reply[0] = 1;
34963500
}
34973501
}
3502+
} else {
3503+
// |context| is unique to signatureInterface: external.
3504+
if (mldsa_funcs.verify(pk.data(), sig.data(), sig.size(), msg.data(),
3505+
msg.size(), context.data(), context.size())) {
3506+
reply[0] = 1;
3507+
}
34983508
}
34993509

35003510
return write_reply({Span<const uint8_t>(reply)});

0 commit comments

Comments
 (0)