Skip to content

Commit 42807d6

Browse files
andrea-caforioandrea-caforio
committed
[crypto] ML-DSA-87: Sample the S vectors
A new routine is introduced to sample the S{1,2} vectors of the secret key. Signed-off-by: Andrea Caforio <andrea.caforio@lowrisc.org>
1 parent ec9d8e2 commit 42807d6

5 files changed

Lines changed: 191 additions & 0 deletions

File tree

‎sw/otbn/crypto/mldsa87/keygen/BUILD‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,6 @@ otbn_binary(
2222
"mldsa87_keygen_expand.s",
2323
"mldsa87_keygen_encoding.s",
2424
"mldsa87_keygen_rounding.s",
25+
"mldsa87_keygen_ops.s",
2526
],
2627
)

‎sw/otbn/crypto/mldsa87/keygen/mldsa87_keygen_ops.s‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
/* Copyright lowRISC contributors (OpenTitan project). */
2+
/* Licensed under the Apache License, Version 2.0, see LICENSE for details. */
3+
/* SPDX-License-Identifier: Apache-2.0 */
4+
5+
/* High-level operations for the ML-DSA key generation function. */
6+
7+
.globl sample_s
8+
9+
.text
10+
11+
/**
12+
* Sample the S{1,2} vectors.
13+
*
14+
* Given a Boolean-shared 66-byte (in a 96-byte region) seed RHO_PRIME, this
15+
* routine expands the S1 and S2 polynomials (see `expand_s1` and `expand_s2`)
16+
* and directly encodes them into the output location. The result are
17+
* Boolean-shared encoded vectors S1 and S2 (2 * 672 byte, 2 * 768 bytes).
18+
*
19+
* Two polynomial slots are required for the storage of intermediate results.
20+
*
21+
* @param[in] x2: DMEM address of the first Boolean share RHO_PRIME.
22+
* @param[in] x3: DMEM address of the second Boolean share RHO_PRIME.
23+
* @param[in] x4: DMEM address of the first Boolean share of the encoded S1.
24+
* @param[in] x5: DMEM address of the second Boolean share of the encoded S1.
25+
* @param[in] x6: DMEM address of the first Boolean share of the encoded S2.
26+
* @param[in] x7: DMEM address of the second Boolean share of the encoded S2.
27+
* @param[in] x8: DMEM address of polynomial slot 0 (1024 bytes).
28+
* @param[in] x9: DMEM address of polynomial slot 1 (1024 bytes).
29+
*/
30+
sample_s:
31+
/* Prepare DMEM address registers. */
32+
addi x10, x2, 0 /* RHO_PRIME (share 0) */
33+
addi x11, x3, 0 /* RHO_PRIME (share 1) */
34+
addi x12, x4, 0 /* S1_enc (share 0) */
35+
addi x13, x5, 0 /* S1_enc (share 1) */
36+
addi x14, x6, 0 /* S2_enc (share 0) */
37+
addi x15, x7, 0 /* S2_enc (share 1) */
38+
39+
addi x16, x0, 0 /* s */
40+
41+
/* Expand the S1 polynomials and encode them. */
42+
loopi 7, 14
43+
/* Expand S1[s] into slots 0 and 1. */
44+
addi x2, x10, 0
45+
addi x3, x11, 0
46+
addi x4, x8, 0
47+
addi x5, x9, 0
48+
addi x6, x16, 0
49+
jal x1, expand_s1
50+
51+
/* Encode S1[s] into the output location. */
52+
addi x2, x8, 0
53+
addi x3, x9, 0
54+
addi x4, x12, 0
55+
addi x5, x13, 0
56+
jal x1, encode_s
57+
58+
/* Advance output pointers and increment s. */
59+
addi x12, x12, 96
60+
addi x13, x13, 96
61+
addi x16, x16, 1
62+
/* End of loop */
63+
64+
addi x16, x0, 0 /* r */
65+
66+
/* Expand the S2 polynomials and encode them. */
67+
loopi 8, 14
68+
/* Expand S2[r] into slots 0 and 1. */
69+
addi x2, x10, 0
70+
addi x3, x11, 0
71+
addi x4, x8, 0
72+
addi x5, x9, 0
73+
addi x6, x16, 0
74+
jal x1, expand_s2
75+
76+
/* Encode S2[r] into the output location. */
77+
addi x2, x8, 0
78+
addi x3, x9, 0
79+
addi x4, x14, 0
80+
addi x5, x15, 0
81+
jal x1, encode_s
82+
83+
/* Advance output pointers and increment r. */
84+
addi x14, x14, 96
85+
addi x15, x15, 96
86+
addi x16, x16, 1
87+
/* End of loop */
88+
89+
ret

‎sw/otbn/crypto/mldsa87/keygen/tests/BUILD‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ srcs = [
2020
"//sw/otbn/crypto/mldsa87/keygen:mldsa87_keygen_expand.s",
2121
"//sw/otbn/crypto/mldsa87/keygen:mldsa87_keygen_encoding.s",
2222
"//sw/otbn/crypto/mldsa87/keygen:mldsa87_keygen_rounding.s",
23+
"//sw/otbn/crypto/mldsa87/keygen:mldsa87_keygen_ops.s",
2324
]
2425

2526
unit_tests = [
@@ -30,6 +31,7 @@ unit_tests = [
3031
"mldsa87_keygen_encode_t1_test",
3132
"mldsa87_keygen_power2round_test",
3233
"mldsa87_keygen_encode_s_test",
34+
"mldsa87_keygen_sample_s_test",
3335
]
3436

3537
[

‎sw/otbn/crypto/mldsa87/keygen/tests/mldsa87_keygen_sample_s_test.hjson‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Copyright lowRISC contributors (OpenTitan project).
2+
// Licensed under the Apache License, Version 2.0, see LICENSE for details.
3+
// SPDX-License-Identifier: Apache-2.0
4+
5+
// NIST ACVP ML-DSA-87 keygen vector #51 (first ML-DSA-87 vector):
6+
// https://github.com/usnistgov/ACVP-Server/blob/master/gen-val/json-files/ML-DSA-keyGen-FIPS204
7+
8+
{
9+
"entrypoint": "main",
10+
"input": {
11+
"dmem": {
12+
// RHO_PRIME
13+
"_sample_s_rho_prime_share0": "0x3af649807ca2405382e16fc376486871f8478741dcb502773f43b3ff7910a4892f75a52f1205580933491c0c9434133ea4660011c521c5df9cf9b54bb701a885",
14+
"_sample_s_rho_prime_share1": "0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
15+
}
16+
},
17+
"output": {
18+
"dmem": {
19+
// Encoded S1
20+
"_sample_s_s1_enc_share0": "0x6241209190638a02010a42998a10c809345324020c4a18822e14d084912190145920b51904b2900992e008b6dc05286065921c7088806020896200dc0e12cc61b8c201a5246d029228020a21a8a02db8dc2a39020814210182448605214980812136c144a60910189c01b8898192594c10a06a17124147202889124635043220d18122082910d25224dc20c2a048286385820289320c30409184848069406160931422201b51b40064461b6a06896d10818190d80480638db2a364b3122d80212a46cb6cc6ca50a30931102072432444c8608db4c460c50c28a4542805148410902ca1082595231036a38d905c2206940ca2532a452240265a8d38e23129186114db04444170860b0184d245b2500844218217028204dc2e48440a384c4a041844880c41810291209a6996db01981022361a69b4d20cc9020228584406c148a2619099016e25190992888d085062230a01c2d32239249130538448e188344106320082211980a6d86908024a248085069a7016107086da12362190229a2c10846d94123082a12980202e486200345430b70210b89066302260c7234cb4e22646c242282291c1032d171461b0d270b5204841128115016128cc4e272244a2c392300382109b8814110034e44c33222187100c270160a28c3122590598919194514d208804b0998144500ca2d14e22e10a491c82290a6096e30c10ca4e091849100846020c2846c012211c5047048088c268045c2da9100826d00816da0989130124032946a320c4c30520db88161101066432311061b48989345b85311b66321a4db8e368328c90b68a29332448c8a20632d30d96a140329c64c2d150464241861a0c83110536104e12da81369848a8d10c02d90611082536614c270040988b2428c240a48231104885a42184390072010471306481051909029a01a0e31244c8",
21+
// Encoded S2
22+
"_sample_s_s2_enc_share0": "0x04292269231268828b64821149c41121b71a0c26988048230902d28044142c248004010091464b6446938933146a26080cc3118406e184008384124965a6037220c22c95229148527220c84db41122492210332160825410081111365a5046434cb4482e36828882da6c80024d32415096118580042e471251a4a02528845034d10d93236036206196544d361349311404949b0508880212c44a34494dc8204432cc6130d088948c4e06800206939218580dc44151291c2c10c829b81245c80148128305150820c64c5210e45118d844a4e46934898c92898d16d42d940b8c42016590082d40cc41c6c04023104048636d481261b8cb21848808272166170b0984c24922a281800c72111820410a92009849a41a5212820d14c991989b4924a30492904510a192085b65860048069988265a6d22108c366450001c88029b8a07018cb8a224984912412111031885210931285c90051a9032192228043224124200e26a00080c204826401a0599146008ca2510c249809a69404a81866086364c08b3228644132530cc2e008428b2920e38220025207106e271c2d060241830225229321264929868448388b4540248818d25203217182039046c945245844c90044972404964090102025b48c84285b91b4541218c024840b7248416d211944a22089c65b4e26614804c22cc0c385444026049c70b8918db4d92832416984da82225a4e12db29949869991b21391872381c0c44644636a290021b65a49a41c8932120d930b00b3118e26a251a21981310b01170842046371104b0106c12803194d482265968a00c51332381289c2546648882d12c94514dc29848b41340345946140452271a44105284450b20a4d87024808404008926c880a6a46a168c6d43232cb08430a64241231186060b80c6893222526c11224046d431b40928a24268241c68a2da11289045168921192169489240171485a84a51a0c00c004c0a161b0a028040291445860188c0c93092980e368a3196a44514022ca84b84249964b4546840db5124422dc0917200a424b60871b84b0812884d21141012e0712462908",
23+
}
24+
}
25+
}

‎sw/otbn/crypto/mldsa87/keygen/tests/mldsa87_keygen_sample_s_test.s‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
/* Copyright lowRISC contributors (OpenTitan project). */
2+
/* Licensed under the Apache License, Version 2.0, see LICENSE for details. */
3+
/* SPDX-License-Identifier: Apache-2.0 */
4+
5+
/* Verify that the we can correctly sample the S{1, 2} vectors. */
6+
7+
.section .text.start
8+
9+
main:
10+
la x31, _stack
11+
bn.xor w31, w31, w31
12+
13+
la x2, _params
14+
bn.lid x0, 0(x2)
15+
bn.wsrw MOD, w0
16+
17+
la x2, _sample_s_rho_prime_share0
18+
la x3, _sample_s_rho_prime_share1
19+
la x4, _sample_s_s1_enc_share0
20+
la x5, _sample_s_s1_enc_share1
21+
la x6, _sample_s_s2_enc_share0
22+
la x7, _sample_s_s2_enc_share1
23+
la x8, _sample_s_slot0
24+
la x9, _sample_s_slot1
25+
jal x1, sample_s
26+
27+
la x20, _sample_s_s1_enc_share0
28+
la x21, _sample_s_s1_enc_share1
29+
addi x22, x0, 21
30+
jal x1, unmask_boolean
31+
32+
la x20, _sample_s_s2_enc_share0
33+
la x21, _sample_s_s2_enc_share1
34+
addi x22, x0, 24
35+
jal x1, unmask_boolean
36+
37+
ecall
38+
39+
.data
40+
.balign 32
41+
42+
_sample_s_rho_prime_share0:
43+
.zero 66
44+
.zero 30 /* Padding */
45+
_sample_s_rho_prime_share1:
46+
.zero 66
47+
.zero 30 /* Padding */
48+
49+
_sample_s_s1_enc_share0:
50+
.zero 672
51+
_sample_s_s1_enc_share1:
52+
.zero 672
53+
_sample_s_s2_enc_share0:
54+
.zero 768
55+
_sample_s_s2_enc_share1:
56+
.zero 768
57+
58+
_sample_s_slot0:
59+
.zero 1024
60+
_sample_s_slot1:
61+
.zero 1024
62+
63+
_params:
64+
.word 0x007fe001 /* q */
65+
.word 0xfc7fdfff /* mu */
66+
.word 0x0000a3fa /* n^-1 * R^3 mod q */
67+
.word 0x00000000
68+
.word 0x00000000
69+
.word 0x00000000
70+
.word 0x00000000
71+
.word 0x00000000
72+
73+
_stack:
74+
.zero 256

0 commit comments

Comments
 (0)