Skip to content

Commit 2ac0eec

Browse files
mkannwischermkannwischer
committed
lowram: Introduce lazy s1hat/s2hat/t0hat types for on-demand unpacking
Introduce mld_sk_s1hat, mld_sk_s2hat, and mld_sk_t0hat types with eager and lazy variants, following the same pattern as mld_polymat for reduced RAM usage. In normal mode, they store the full NTT'd vectors. In REDUCE_RAM mode, they store a pointer to the packed data in the secret key and unpack + NTT individual polynomials on demand. The eager and lazy variants are defined as separate struct types (mld_sk_{s1hat,s2hat,t0hat}_{eager,lazy}) with dedicated mld_unpack_sk_* and mld_sk_*_get_poly functions, in a new header polyvec_lazy.h. MLD_CONFIG_REDUCE_RAM selects the active variant via typedef/define. pk_from_sk inlines the secret key unpacking directly, since it needs raw polynomial vectors rather than the lazy/eager NTT'd types. Add a unit test verifying that eager and lazy init+get produce identical results for all indices across s1hat, s2hat, and t0hat. Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>
1 parent 9ee2f35 commit 2ac0eec

File tree

32 files changed

+782
-148
lines changed

32 files changed

+782
-148
lines changed

‎.github/workflows/integration-opentitan.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,16 @@ jobs:
8080
echo "=== Patched extensions.bzl ==="
8181
cat third_party/mldsa_native/extensions.bzl
8282
83+
- name: Apply integration patches
84+
run: |
85+
cd "$EXPO_DIR"
86+
for patch in "$GITHUB_WORKSPACE"/integration/opentitan/*.patch; do
87+
if [ -f "$patch" ]; then
88+
echo "Applying $patch"
89+
git apply "$patch"
90+
fi
91+
done
92+
8393
- name: Build mldsa functest
8494
run: |
8595
cd "$EXPO_DIR"

‎examples/bring_your_own_fips202/mldsa_native/src/polyvec_lazy.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../../mldsa/src/polyvec_lazy.h

‎examples/bring_your_own_fips202_static/mldsa_native/src/polyvec_lazy.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../../mldsa/src/polyvec_lazy.h

‎examples/custom_backend/mldsa_native/src/polyvec_lazy.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../../mldsa/src/polyvec_lazy.h

‎integration/liboqs/ML-DSA-44_META.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ implementations:
3535
mldsa/src/cbmc.h mldsa/src/common.h mldsa/src/ct.c mldsa/src/ct.h mldsa/src/debug.c
3636
mldsa/src/debug.h mldsa/src/packing.c mldsa/src/packing.h mldsa/src/params.h mldsa/src/poly.c
3737
mldsa/src/poly.h mldsa/src/poly_kl.c mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h
38-
mldsa/src/randombytes.h mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c
39-
mldsa/src/sign.h mldsa/src/symmetric.h mldsa/src/sys.h mldsa/src/zetas.inc
38+
mldsa/src/polyvec_lazy.h mldsa/src/randombytes.h mldsa/src/reduce.h mldsa/src/rounding.h
39+
mldsa/src/sign.c mldsa/src/sign.h mldsa/src/symmetric.h mldsa/src/sys.h mldsa/src/zetas.inc
4040
- name: x86_64
4141
version: FIPS204
4242
folder_name: .
@@ -51,9 +51,9 @@ implementations:
5151
mldsa/src/cbmc.h mldsa/src/common.h mldsa/src/ct.c mldsa/src/ct.h mldsa/src/debug.c
5252
mldsa/src/debug.h mldsa/src/native/api.h mldsa/src/native/meta.h mldsa/src/packing.c
5353
mldsa/src/packing.h mldsa/src/params.h mldsa/src/poly.c mldsa/src/poly.h mldsa/src/poly_kl.c
54-
mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h mldsa/src/randombytes.h
55-
mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c mldsa/src/sign.h mldsa/src/symmetric.h
56-
mldsa/src/sys.h mldsa/src/zetas.inc mldsa/src/native/x86_64
54+
mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h mldsa/src/polyvec_lazy.h
55+
mldsa/src/randombytes.h mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c
56+
mldsa/src/sign.h mldsa/src/symmetric.h mldsa/src/sys.h mldsa/src/zetas.inc mldsa/src/native/x86_64
5757
supported_platforms:
5858
- architecture: x86_64
5959
operating_systems:
@@ -77,9 +77,9 @@ implementations:
7777
mldsa/src/cbmc.h mldsa/src/common.h mldsa/src/ct.c mldsa/src/ct.h mldsa/src/debug.c
7878
mldsa/src/debug.h mldsa/src/native/api.h mldsa/src/native/meta.h mldsa/src/packing.c
7979
mldsa/src/packing.h mldsa/src/params.h mldsa/src/poly.c mldsa/src/poly.h mldsa/src/poly_kl.c
80-
mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h mldsa/src/randombytes.h
81-
mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c mldsa/src/sign.h mldsa/src/symmetric.h
82-
mldsa/src/sys.h mldsa/src/zetas.inc mldsa/src/native/aarch64
80+
mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h mldsa/src/polyvec_lazy.h
81+
mldsa/src/randombytes.h mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c
82+
mldsa/src/sign.h mldsa/src/symmetric.h mldsa/src/sys.h mldsa/src/zetas.inc mldsa/src/native/aarch64
8383
supported_platforms:
8484
- architecture: arm_8
8585
operating_systems:

‎integration/liboqs/ML-DSA-65_META.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ implementations:
3535
mldsa/src/cbmc.h mldsa/src/common.h mldsa/src/ct.c mldsa/src/ct.h mldsa/src/debug.c
3636
mldsa/src/debug.h mldsa/src/packing.c mldsa/src/packing.h mldsa/src/params.h mldsa/src/poly.c
3737
mldsa/src/poly.h mldsa/src/poly_kl.c mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h
38-
mldsa/src/randombytes.h mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c
39-
mldsa/src/sign.h mldsa/src/symmetric.h mldsa/src/sys.h mldsa/src/zetas.inc
38+
mldsa/src/polyvec_lazy.h mldsa/src/randombytes.h mldsa/src/reduce.h mldsa/src/rounding.h
39+
mldsa/src/sign.c mldsa/src/sign.h mldsa/src/symmetric.h mldsa/src/sys.h mldsa/src/zetas.inc
4040
- name: x86_64
4141
version: FIPS204
4242
folder_name: .
@@ -51,9 +51,9 @@ implementations:
5151
mldsa/src/cbmc.h mldsa/src/common.h mldsa/src/ct.c mldsa/src/ct.h mldsa/src/debug.c
5252
mldsa/src/debug.h mldsa/src/native/api.h mldsa/src/native/meta.h mldsa/src/packing.c
5353
mldsa/src/packing.h mldsa/src/params.h mldsa/src/poly.c mldsa/src/poly.h mldsa/src/poly_kl.c
54-
mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h mldsa/src/randombytes.h
55-
mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c mldsa/src/sign.h mldsa/src/symmetric.h
56-
mldsa/src/sys.h mldsa/src/zetas.inc mldsa/src/native/x86_64
54+
mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h mldsa/src/polyvec_lazy.h
55+
mldsa/src/randombytes.h mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c
56+
mldsa/src/sign.h mldsa/src/symmetric.h mldsa/src/sys.h mldsa/src/zetas.inc mldsa/src/native/x86_64
5757
supported_platforms:
5858
- architecture: x86_64
5959
operating_systems:
@@ -77,9 +77,9 @@ implementations:
7777
mldsa/src/cbmc.h mldsa/src/common.h mldsa/src/ct.c mldsa/src/ct.h mldsa/src/debug.c
7878
mldsa/src/debug.h mldsa/src/native/api.h mldsa/src/native/meta.h mldsa/src/packing.c
7979
mldsa/src/packing.h mldsa/src/params.h mldsa/src/poly.c mldsa/src/poly.h mldsa/src/poly_kl.c
80-
mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h mldsa/src/randombytes.h
81-
mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c mldsa/src/sign.h mldsa/src/symmetric.h
82-
mldsa/src/sys.h mldsa/src/zetas.inc mldsa/src/native/aarch64
80+
mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h mldsa/src/polyvec_lazy.h
81+
mldsa/src/randombytes.h mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c
82+
mldsa/src/sign.h mldsa/src/symmetric.h mldsa/src/sys.h mldsa/src/zetas.inc mldsa/src/native/aarch64
8383
supported_platforms:
8484
- architecture: arm_8
8585
operating_systems:

‎integration/liboqs/ML-DSA-87_META.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ implementations:
3535
mldsa/src/cbmc.h mldsa/src/common.h mldsa/src/ct.c mldsa/src/ct.h mldsa/src/debug.c
3636
mldsa/src/debug.h mldsa/src/packing.c mldsa/src/packing.h mldsa/src/params.h mldsa/src/poly.c
3737
mldsa/src/poly.h mldsa/src/poly_kl.c mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h
38-
mldsa/src/randombytes.h mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c
39-
mldsa/src/sign.h mldsa/src/symmetric.h mldsa/src/sys.h mldsa/src/zetas.inc
38+
mldsa/src/polyvec_lazy.h mldsa/src/randombytes.h mldsa/src/reduce.h mldsa/src/rounding.h
39+
mldsa/src/sign.c mldsa/src/sign.h mldsa/src/symmetric.h mldsa/src/sys.h mldsa/src/zetas.inc
4040
- name: x86_64
4141
version: FIPS204
4242
folder_name: .
@@ -51,9 +51,9 @@ implementations:
5151
mldsa/src/cbmc.h mldsa/src/common.h mldsa/src/ct.c mldsa/src/ct.h mldsa/src/debug.c
5252
mldsa/src/debug.h mldsa/src/native/api.h mldsa/src/native/meta.h mldsa/src/packing.c
5353
mldsa/src/packing.h mldsa/src/params.h mldsa/src/poly.c mldsa/src/poly.h mldsa/src/poly_kl.c
54-
mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h mldsa/src/randombytes.h
55-
mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c mldsa/src/sign.h mldsa/src/symmetric.h
56-
mldsa/src/sys.h mldsa/src/zetas.inc mldsa/src/native/x86_64
54+
mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h mldsa/src/polyvec_lazy.h
55+
mldsa/src/randombytes.h mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c
56+
mldsa/src/sign.h mldsa/src/symmetric.h mldsa/src/sys.h mldsa/src/zetas.inc mldsa/src/native/x86_64
5757
supported_platforms:
5858
- architecture: x86_64
5959
operating_systems:
@@ -77,9 +77,9 @@ implementations:
7777
mldsa/src/cbmc.h mldsa/src/common.h mldsa/src/ct.c mldsa/src/ct.h mldsa/src/debug.c
7878
mldsa/src/debug.h mldsa/src/native/api.h mldsa/src/native/meta.h mldsa/src/packing.c
7979
mldsa/src/packing.h mldsa/src/params.h mldsa/src/poly.c mldsa/src/poly.h mldsa/src/poly_kl.c
80-
mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h mldsa/src/randombytes.h
81-
mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c mldsa/src/sign.h mldsa/src/symmetric.h
82-
mldsa/src/sys.h mldsa/src/zetas.inc mldsa/src/native/aarch64
80+
mldsa/src/poly_kl.h mldsa/src/polyvec.c mldsa/src/polyvec.h mldsa/src/polyvec_lazy.h
81+
mldsa/src/randombytes.h mldsa/src/reduce.h mldsa/src/rounding.h mldsa/src/sign.c
82+
mldsa/src/sign.h mldsa/src/symmetric.h mldsa/src/sys.h mldsa/src/zetas.inc mldsa/src/native/aarch64
8383
supported_platforms:
8484
- architecture: arm_8
8585
operating_systems:

‎integration/opentitan/add_polyvec_lazy.patch‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Copyright (c) The mldsa-native project authors
2+
# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
3+
diff --git a/third_party/mldsa_native/BUILD.mldsa_native.bazel b/third_party/mldsa_native/BUILD.mldsa_native.bazel
4+
index 8a63d09..1c576c2 100644
5+
--- a/third_party/mldsa_native/BUILD.mldsa_native.bazel
6+
+++ b/third_party/mldsa_native/BUILD.mldsa_native.bazel
7+
@@ -26,6 +26,7 @@ cc_library(
8+
"mldsa/src/poly_kl.h",
9+
"mldsa/src/polyvec.c",
10+
"mldsa/src/polyvec.h",
11+
+ "mldsa/src/polyvec_lazy.h",
12+
"mldsa/src/reduce.h",
13+
"mldsa/src/rounding.h",
14+
"mldsa/src/sign.c",

‎integration/opentitan/reduce_alloc.patch‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Copyright (c) The mldsa-native project authors
2+
# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
3+
diff --git a/sw/device/lib/crypto/include/mldsa.h b/sw/device/lib/crypto/include/mldsa.h
4+
index be11f20..26351ee 100644
5+
--- a/sw/device/lib/crypto/include/mldsa.h
6+
+++ b/sw/device/lib/crypto/include/mldsa.h
7+
@@ -41,16 +41,16 @@ enum {
8+
kOtcryptoMldsa87SeedBytes = 32,
9+
10+
// Work buffer sizes in 32-bit words
11+
- kOtcryptoMldsa44WorkBufferKeypairWords = 32992 / sizeof(uint32_t),
12+
- kOtcryptoMldsa44WorkBufferSignWords = 32448 / sizeof(uint32_t),
13+
+ kOtcryptoMldsa44WorkBufferKeypairWords = 28960 / sizeof(uint32_t),
14+
+ kOtcryptoMldsa44WorkBufferSignWords = 20256 / sizeof(uint32_t),
15+
kOtcryptoMldsa44WorkBufferVerifyWords = 22464 / sizeof(uint32_t),
16+
17+
- kOtcryptoMldsa65WorkBufferKeypairWords = 46304 / sizeof(uint32_t),
18+
- kOtcryptoMldsa65WorkBufferSignWords = 44768 / sizeof(uint32_t),
19+
+ kOtcryptoMldsa65WorkBufferKeypairWords = 40224 / sizeof(uint32_t),
20+
+ kOtcryptoMldsa65WorkBufferSignWords = 27456 / sizeof(uint32_t),
21+
kOtcryptoMldsa65WorkBufferVerifyWords = 30720 / sizeof(uint32_t),
22+
23+
- kOtcryptoMldsa87WorkBufferKeypairWords = 62688 / sizeof(uint32_t),
24+
- kOtcryptoMldsa87WorkBufferSignWords = 59104 / sizeof(uint32_t),
25+
+ kOtcryptoMldsa87WorkBufferKeypairWords = 54560 / sizeof(uint32_t),
26+
+ kOtcryptoMldsa87WorkBufferSignWords = 35648 / sizeof(uint32_t),
27+
kOtcryptoMldsa87WorkBufferVerifyWords = 41216 / sizeof(uint32_t),
28+
};
29+

‎mldsa/mldsa_native.c‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,7 @@
177177
#undef MLD_ERR_RNG_FAIL
178178
#undef MLD_H
179179
#undef MLD_MAX3_
180+
#undef MLD_MAX4_
180181
#undef MLD_PREHASH_NONE
181182
#undef MLD_PREHASH_SHA2_224
182183
#undef MLD_PREHASH_SHA2_256
@@ -194,18 +195,21 @@
194195
#undef MLD_TOTAL_ALLOC_44_KEYPAIR
195196
#undef MLD_TOTAL_ALLOC_44_KEYPAIR_NO_PCT
196197
#undef MLD_TOTAL_ALLOC_44_KEYPAIR_PCT
198+
#undef MLD_TOTAL_ALLOC_44_PK_FROM_SK
197199
#undef MLD_TOTAL_ALLOC_44_SIGN
198200
#undef MLD_TOTAL_ALLOC_44_VERIFY
199201
#undef MLD_TOTAL_ALLOC_65
200202
#undef MLD_TOTAL_ALLOC_65_KEYPAIR
201203
#undef MLD_TOTAL_ALLOC_65_KEYPAIR_NO_PCT
202204
#undef MLD_TOTAL_ALLOC_65_KEYPAIR_PCT
205+
#undef MLD_TOTAL_ALLOC_65_PK_FROM_SK
203206
#undef MLD_TOTAL_ALLOC_65_SIGN
204207
#undef MLD_TOTAL_ALLOC_65_VERIFY
205208
#undef MLD_TOTAL_ALLOC_87
206209
#undef MLD_TOTAL_ALLOC_87_KEYPAIR
207210
#undef MLD_TOTAL_ALLOC_87_KEYPAIR_NO_PCT
208211
#undef MLD_TOTAL_ALLOC_87_KEYPAIR_PCT
212+
#undef MLD_TOTAL_ALLOC_87_PK_FROM_SK
209213
#undef MLD_TOTAL_ALLOC_87_SIGN
210214
#undef MLD_TOTAL_ALLOC_87_VERIFY
211215
#undef crypto_sign
@@ -337,6 +341,35 @@
337341
#undef mld_polyvecl_uniform_gamma1
338342
#undef mld_polyvecl_unpack_eta
339343
#undef mld_polyvecl_unpack_z
344+
/* mldsa/src/polyvec_lazy.h */
345+
#undef MLD_POLYVEC_LAZY_H
346+
#undef mld_sk_s1hat
347+
#undef mld_sk_s1hat_eager
348+
#undef mld_sk_s1hat_get_poly
349+
#undef mld_sk_s1hat_get_poly_eager
350+
#undef mld_sk_s1hat_get_poly_lazy
351+
#undef mld_sk_s1hat_lazy
352+
#undef mld_sk_s2hat
353+
#undef mld_sk_s2hat_eager
354+
#undef mld_sk_s2hat_get_poly
355+
#undef mld_sk_s2hat_get_poly_eager
356+
#undef mld_sk_s2hat_get_poly_lazy
357+
#undef mld_sk_s2hat_lazy
358+
#undef mld_sk_t0hat
359+
#undef mld_sk_t0hat_eager
360+
#undef mld_sk_t0hat_get_poly
361+
#undef mld_sk_t0hat_get_poly_eager
362+
#undef mld_sk_t0hat_get_poly_lazy
363+
#undef mld_sk_t0hat_lazy
364+
#undef mld_unpack_sk_s1hat
365+
#undef mld_unpack_sk_s1hat_eager
366+
#undef mld_unpack_sk_s1hat_lazy
367+
#undef mld_unpack_sk_s2hat
368+
#undef mld_unpack_sk_s2hat_eager
369+
#undef mld_unpack_sk_s2hat_lazy
370+
#undef mld_unpack_sk_t0hat
371+
#undef mld_unpack_sk_t0hat_eager
372+
#undef mld_unpack_sk_t0hat_lazy
340373
/* mldsa/src/rounding.h */
341374
#undef MLD_2_POW_D
342375
#undef MLD_ROUNDING_H

0 commit comments

Comments
 (0)