[crypto] ML-DSA-87: Public-key hashing

Signed-off-by: Andrea Caforio <andrea.caforio@lowrisc.org>

Author: andrea-caforio

sw/otbn/crypto/mldsa87/keygen/mldsa87_keygen_ops.s

@@ -8,6 +8,7 @@
 .globl compute_t
 .globl encode_t
 .globl hash_seed
+.globl hash_pk
 
 .text
 
@@ -383,3 +384,35 @@ hash_seed:
   jal x1, xof_finish
 
   ret
+
+/**
+ * Hash the public key.
+ *
+ * The hash of the 2592-byte public key is 64-byte unshared value TR.
+ *
+ *   TR = Shake256(PK)
+ *
+ * @param[in] x2: DMEM address of the 2592-byte public key.
+ * @param[in] x3: DMEM address of TR.
+ */
+hash_pk:
+  jal x1, xof_shake256_init
+
+  /* Absorb the entire public key of size 2592 bytes. */
+  li x20, 2592
+  addi x21, x2, 0
+  addi x22, x0, 0
+  jal x1, xof_absorb
+  jal x1, xof_process
+
+  /* Squeeze the 64-byte value TR. */
+  jal x1, xof_squeeze32
+  bn.xor w0, w29, w30 /* unmask */
+  bn.sid x0, 0(x3)
+  jal x1, xof_squeeze32
+  bn.xor w0, w29, w30 /* unmask */
+  bn.sid x0, 32(x3)
+
+  jal x1, xof_finish
+
+  ret

sw/otbn/crypto/mldsa87/keygen/tests/BUILD

@@ -35,6 +35,7 @@ unit_tests = [
     "mldsa87_keygen_compute_t_test",
     "mldsa87_keygen_encode_t_test",
     "mldsa87_keygen_hash_seed_test",
+    "mldsa87_keygen_hash_pk_test",
 ]
 
 [

sw/otbn/crypto/mldsa87/keygen/tests/mldsa87_keygen_hash_pk_test.hjson

@@ -0,0 +1,22 @@
+// Copyright lowRISC contributors (OpenTitan project).
+// Licensed under the Apache License, Version 2.0, see LICENSE for details.
+// SPDX-License-Identifier: Apache-2.0
+
+// NIST ACVP ML-DSA-87 keygen vector #51 (first ML-DSA-87 vector):
+// https://github.com/usnistgov/ACVP-Server/blob/master/gen-val/json-files/ML-DSA-keyGen-FIPS204
+
+{
+  "entrypoint": "main",
+  "input": {
+    "dmem": {
+      // PK
+      "_hash_pk_pk": "0x3ccf9e0d43e289a6ed73e09e6168d78f4ad686add2c0fba08d69165ae15d50c7abe34c877400a3414c842c03a761946f64e32ae1602d11e96d575778da73e4bada7f9cd6c9efa0c0f0edd41f74ba50e4d375c36152db752cc7303a9571ea40db224f2c6c53c9909be34e5960822b6aa54e57b099ae8010c3ea32ddc75a5cb38a7cc8ac5a42cc78785a789ba6305404565093d89a37973ec14cef34f54569de385248758263f0bfc599f5c99bb985d32262987f59802a3b4f9bac6ba73e845e41577e9cb5fcfad46d4647d852ee1a8c132594cd8035761ed072e5026079511b1a7d4716d2a1f37944dc10d2f6fac98ce76dc787f1108c1e8d70a86220860619b0d78188a8d5b81864e268e95aa1ac5e8421eb0230133710c5c61f860e342e92a0541e0f89c1ad53e3319666e21273112502a6c0dd4c534eed61df9c070c4b129ee619b009151511648bc762dfd00cfaa14c652bf3bcd6a26e96af6f1cf4a0f21fa5b5a421de5f687c89c94c6579f10e25099f5e954decf4de70b621c053ea39838b46b012b0e4516a5c26a9b67425d85e2df27b43c1e6ea9970a3899a2f00db43b931e7017e9166f62e31cb9266eaf8675c8aeaac9212ee79f27381b0c0f2a342ea8c4271a0be007437f4fb29f4a20c016b9b58a902d59331c0ee9f4ab3abcf459b7e312c26d2f4a85570209d36742e204f7695f8cbd3179acbb33a578818364d4785080940fff60eec7d704abbe2400383c03bdbd80fe35944f2c66088fdd15c3520c402c522526ffa0af12767bd4136396f7b9307f46f329d7847319a03778da428605282c300ab7c32820427e6be7ed1fde1f18a0a8b4c44ce4e6849ad5f77576766455504239d91bbaac73d7a24d1b296c4342c3eb1ed286ae2d95c9322225d8fc1dc130f7cfc2bcfa7117daae44223f4ce171758bbb861f6a3f8f9fea76109467cc2cb6b2a3d547b47545ff05998555d140bcfa6b5faf1cd24f7f9d27c0dcd876bdc3a356859935711ae084ebe5b268d628b812aa9deab1e7cdabbca01b12efc398cef7e9f9a77ec94a429084a5ef39c972e27dda0e648ca4d64877d5c68125e7c4f93dff2b13a2e5f517a06f62b6ff8a14f36005456ed2c5a54f303c42c8ae9b311d2d2ac4daf9612499956c15377a8bea81bc96b181e92a1c8195e390ee18c183a9fa6ced542104f47127593223ac34973ec15033a1f65a043197845693dc22d86f0a84fab548a39ecb3737aa6527ad09810caedf660c4ad0b3201ff7a387c4e03a318754856e016207cd56d949436ebb136cf0db83f0d972135145b48cd4ed3e0ca190f0365240f40a9fbc44a009f621a43924f33fae8cb95862db535da141df78f731b0f6146728ede4d34eb67bf9df6c56674bf7b7c1ff324396b829994235bd596cf91af181af40e03fdcfc1b5fde7a58a93751ba6a34843883579eb594ae27dd7e2622caf1eb5814871df879a381f8138aa827fa01bfebc26e23d587921aba11cb4f588fcc574b38569c3ae3b1408ab3d128e476db63929d8cc084312e92f7d49b96eb7e7ff43d5c1fbc58e724f708f4356cf0b0880e3df3946907c38e98e128610935a5912d5bc4b7a9ded39a5c0dd71807d6e5ea39c321e138a593df7da0019a1253ccc056453309b0643c4aaaba969042301091042248e4c7fed4ba69a8296960152259c273a462a8d82c4715b874e68feece035972522579b36c7c2341ea86e495e097f4975f136dc3cce0ae173b8e23e0f360033ad9e307f1554550278c6312dd3aba31225e8ec1124f2b9d1a8ce334d274471c2c81134cefe19b3c72a1acdea7a94d99c9c6ed845b279de4b6761e16018251f638a6b2d271b02f7921f73936c43f3ce4f281708a19643d97a4c335158bbda0bad392e696b6332068b6891abfe5b3736869d49c9ef98a9b743cfff75a45cf83643099adfe35afb6557bc2e0047f134fd420ce4b75a6c59538f44bb14cab111204e7e578df3ec752f2efd69486e8f57d3aa00d62748047cff888672aaabe873a880c51f3565a7ca0aad51c34712da0ce65f1fa0583e7e819bfea7d88522970c746fe838a101ef369cf5a08ec41123c5be2e25eb1ec9be3a8fed04b830dffbfbe457efdffebd3870976f5f4eb8aac2681fa831b0b84853b430b28c9cff72fb1103a2aab31e1aeaeb54ac114a30e2dd812f158e9c10b77fbb8c1a4169f0a8e2568258376810f59eba6f524ebfbcd35d31e306593ab4807d98e586c2176fb3e064b19e9d926fd1cb25fe1a129ee30930c4ab10ed71b18826b2424c9cd1c4bf78ac74afb9dc83a465f01619e84103c2832016ef64ba99a25a30bbd474b26075532ddf31c8e810cf8f571b03d1d2e7aad01f9ae2f6979ff91ebfc9558cdfc644a322ab43befc430ca006aee29a4a095e13b6e9c959200d8093d68585fc5d1baa44e8f051baf3da1286873fe8c01b6e59555a775ed30082a15b6a8ab775e1da13ce47fc8b39cbc84d0ea2a40348fa99aa1877a3f0f4bbf0f74991a456b416de90ffef3b2d5061bf772591a943154fc6a03249c5df877ba0aab6554e3e78468f3a65569279fba76610b403200e85ecb16133842d22cf365354636845a4ddc1fb6cfb8a3b67aae1ffed7cd07d6360f712e4c7d7df074701df2ed8274fdbf3bf3f2b476fd9ab9d9b8c729c8343739b00dc31485a2118af6ae91447e1134a73fb708a4016104eb0fce6ec8fb8c0ceab67cf448063ffadf05e8e20c65157341eecba53d6c4679abc177b45e09ed4cf22fa6b35a42fbf5966d38bfa3f66d9238ab2a6aa0304ef3b9cd258f0cac59fe436ec1fb7a2658681214ca16c73a0d4ea3e8de224d8325ef9f63bd38433e32798e2e4945cbf8ee2431be678f478a421c586a412c07e12818180f509f286d439fcac2dacebb5f7e11e1cca84c2803efc1c825a64bd18e1a9e19bcfcefafd73ebafa360aa00febdc1ba7035ba15cc2079ba31d05edd9692e9030ca3e06c6961617422c12fe8a863d8bef164cd3cdb77b0a125230cf7650cdf5fe9d860e4e31409e0cd2c113e6f8706f9d9ff4b5c55114287901d20964ec17fcd8495d31cbadc95c82e252e7ec5eba0e95b2df573c4bc849414855dfc2902d26f64a8e87a32ba2939f2916af4cd7d324d312c67fde2ca68cbf1e4b2ff9c2a2bcee3cafa218376aa8a1b81cde2168850e964f1ff7fb9b59da25b937be5f53f4065b94c487e9469d60a93d5406fd6560534ab04711d26a5a81c3f3f79682e681ab838c650f84adfe22fd208c818022e83a571a69645219b855b0ad6a163476a895fa02f276d6cb6b3ed5092b1f6fa88af4ab719ea4cd357adda5813fe3caacb247ac66532c2460f72e5aad22eb5887cee14c18994d8df0886c80ab8f2f94fb4a87081548e2bd5f0e1152bad81ce9470b5bfb05c33d1e008dba04624823dd36ba0e4c2455182ae5402dc77424d0a94063ae9d451f3b4553cf7aa0c237b0ab2736c46f87122eb54fdf46cfed68b0b125621e4fd7522741e74d4f161b22d413e3060b240b06e07ca4e6a47aa1289b4632d5ef9c334dd2a6087f20065928cb65fd38270be94e2da9f6c7b7605b8b471dbf6ed1d348e42e8ab18b9dc34f5c2be852b186febf7af6cd937df8c3fe571dcc9de94cd892d91cfcdb5e640a21935a26e75f5de92f3df18",
+    }
+  },
+  "output": {
+    "dmem": {
+      // TR
+      "_hash_pk_tr": "0xdd464db824b5b670eb153287f6421e2b3f4cbbb159ac95e27c054141300e5eaa25861d7873c217cf1f96887b370dc1ce446a274ae172d33c9bf1d73d02226cb6",
+    }
+  }
+}

sw/otbn/crypto/mldsa87/keygen/tests/mldsa87_keygen_hash_pk_test.s

@@ -0,0 +1,42 @@
+/* Copyright lowRISC contributors (OpenTitan project). */
+/* Licensed under the Apache License, Version 2.0, see LICENSE for details. */
+/* SPDX-License-Identifier: Apache-2.0 */
+
+/* Verify that we can correctly hash the public key. */
+
+.section .text.start
+
+main:
+  la x31, _stack
+  bn.xor w31, w31, w31
+
+  la x2, _params
+  bn.lid x0, 0(x2)
+  bn.wsrw MOD, w0
+
+  la x2, _hash_pk_pk
+  la x3, _hash_pk_tr
+  jal x1, hash_pk
+
+  ecall
+
+.data
+.balign 32
+
+_hash_pk_pk:
+.zero 2592
+_hash_pk_tr:
+.zero 64
+
+_params:
+.word 0x007fe001 /* q */
+.word 0xfc7fdfff /* mu */
+.word 0x0000a3fa /* n^-1 * R^3 mod q */
+.word 0x00000000
+.word 0x00000000
+.word 0x00000000
+.word 0x00000000
+.word 0x00000000
+
+_stack:
+.zero 256