sign: Use MLD_ALLOC for secret seed/rnd buffers in sign.c

Convert the stack-allocated rnd/seed buffers in the public sign API
wrappers to MLD_ALLOC so that consumers using a custom allocator
(MLD_CONFIG_CUSTOM_ALLOC_FREE) place RNG-derived secret material
through the same allocation path.

Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>

Author: mkannwischer

integration/opentitan/reduce_alloc.patch

@@ -1,32 +1,33 @@
 # Copyright (c) The mldsa-native project authors
 # SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
 diff --git a/sw/device/lib/crypto/include/mldsa.h b/sw/device/lib/crypto/include/mldsa.h
-index be11f20..0000000 100644
+index be11f20..9112042 100644
 --- a/sw/device/lib/crypto/include/mldsa.h
 +++ b/sw/device/lib/crypto/include/mldsa.h
-@@ -41,15 +41,15 @@ enum {
+@@ -41,17 +41,17 @@ enum {
    kOtcryptoMldsa87SeedBytes = 32,
-
+ 
    // Work buffer sizes in 32-bit words
 -  kOtcryptoMldsa44WorkBufferKeypairWords = 32992 / sizeof(uint32_t),
 -  kOtcryptoMldsa44WorkBufferSignWords = 32448 / sizeof(uint32_t),
 -  kOtcryptoMldsa44WorkBufferVerifyWords = 22464 / sizeof(uint32_t),
-+  kOtcryptoMldsa44WorkBufferKeypairWords = 13600 / sizeof(uint32_t),
++  kOtcryptoMldsa44WorkBufferKeypairWords = 13632 / sizeof(uint32_t),
 +  kOtcryptoMldsa44WorkBufferSignWords = 13120 / sizeof(uint32_t),
 +  kOtcryptoMldsa44WorkBufferVerifyWords = 13184 / sizeof(uint32_t),
-
+ 
 -  kOtcryptoMldsa65WorkBufferKeypairWords = 46304 / sizeof(uint32_t),
 -  kOtcryptoMldsa65WorkBufferSignWords = 44768 / sizeof(uint32_t),
 -  kOtcryptoMldsa65WorkBufferVerifyWords = 30720 / sizeof(uint32_t),
-+  kOtcryptoMldsa65WorkBufferKeypairWords = 19744 / sizeof(uint32_t),
++  kOtcryptoMldsa65WorkBufferKeypairWords = 19776 / sizeof(uint32_t),
 +  kOtcryptoMldsa65WorkBufferSignWords = 17248 / sizeof(uint32_t),
 +  kOtcryptoMldsa65WorkBufferVerifyWords = 18368 / sizeof(uint32_t),
-
+ 
 -  kOtcryptoMldsa87WorkBufferKeypairWords = 62688 / sizeof(uint32_t),
 -  kOtcryptoMldsa87WorkBufferSignWords = 59104 / sizeof(uint32_t),
 -  kOtcryptoMldsa87WorkBufferVerifyWords = 41216 / sizeof(uint32_t),
-+  kOtcryptoMldsa87WorkBufferKeypairWords = 25888 / sizeof(uint32_t),
++  kOtcryptoMldsa87WorkBufferKeypairWords = 25920 / sizeof(uint32_t),
 +  kOtcryptoMldsa87WorkBufferSignWords = 21344 / sizeof(uint32_t),
 +  kOtcryptoMldsa87WorkBufferVerifyWords = 24768 / sizeof(uint32_t),
  };
-
+ 
+ /**

mldsa/mldsa_native.h

@@ -938,34 +938,34 @@ int MLD_API_NAMESPACE(pk_from_sk)(
  */
 /* check-magic: off */
 #if defined(MLD_API_LEGACY_CONFIG) || !defined(MLD_CONFIG_REDUCE_RAM)
-#define MLD_TOTAL_ALLOC_44_KEYPAIR_NO_PCT 28928
-#define MLD_TOTAL_ALLOC_44_KEYPAIR_PCT 48448
+#define MLD_TOTAL_ALLOC_44_KEYPAIR_NO_PCT 28960
+#define MLD_TOTAL_ALLOC_44_KEYPAIR_PCT 48480
 #define MLD_TOTAL_ALLOC_44_PK_FROM_SK 37056
 #define MLD_TOTAL_ALLOC_44_SIGN 44704
 #define MLD_TOTAL_ALLOC_44_VERIFY 25472
-#define MLD_TOTAL_ALLOC_65_KEYPAIR_NO_PCT 49408
-#define MLD_TOTAL_ALLOC_65_KEYPAIR_PCT 74592
+#define MLD_TOTAL_ALLOC_65_KEYPAIR_NO_PCT 49440
+#define MLD_TOTAL_ALLOC_65_KEYPAIR_PCT 74624
 #define MLD_TOTAL_ALLOC_65_PK_FROM_SK 60608
 #define MLD_TOTAL_ALLOC_65_SIGN 69312
 #define MLD_TOTAL_ALLOC_65_VERIFY 42944
-#define MLD_TOTAL_ALLOC_87_KEYPAIR_NO_PCT 82176
-#define MLD_TOTAL_ALLOC_87_KEYPAIR_PCT 115456
+#define MLD_TOTAL_ALLOC_87_KEYPAIR_NO_PCT 82208
+#define MLD_TOTAL_ALLOC_87_KEYPAIR_PCT 115488
 #define MLD_TOTAL_ALLOC_87_PK_FROM_SK 97472
 #define MLD_TOTAL_ALLOC_87_SIGN 108224
 #define MLD_TOTAL_ALLOC_87_VERIFY 73920
 #else /* MLD_API_LEGACY_CONFIG || !MLD_CONFIG_REDUCE_RAM */
-#define MLD_TOTAL_ALLOC_44_KEYPAIR_NO_PCT 13600
-#define MLD_TOTAL_ALLOC_44_KEYPAIR_PCT 16928
+#define MLD_TOTAL_ALLOC_44_KEYPAIR_NO_PCT 13632
+#define MLD_TOTAL_ALLOC_44_KEYPAIR_PCT 16960
 #define MLD_TOTAL_ALLOC_44_PK_FROM_SK 21728
 #define MLD_TOTAL_ALLOC_44_SIGN 13120
 #define MLD_TOTAL_ALLOC_44_VERIFY 13184
-#define MLD_TOTAL_ALLOC_65_KEYPAIR_NO_PCT 19744
-#define MLD_TOTAL_ALLOC_65_KEYPAIR_PCT 23648
+#define MLD_TOTAL_ALLOC_65_KEYPAIR_NO_PCT 19776
+#define MLD_TOTAL_ALLOC_65_KEYPAIR_PCT 23680
 #define MLD_TOTAL_ALLOC_65_PK_FROM_SK 30944
 #define MLD_TOTAL_ALLOC_65_SIGN 17248
 #define MLD_TOTAL_ALLOC_65_VERIFY 18368
-#define MLD_TOTAL_ALLOC_87_KEYPAIR_NO_PCT 25888
-#define MLD_TOTAL_ALLOC_87_KEYPAIR_PCT 32000
+#define MLD_TOTAL_ALLOC_87_KEYPAIR_NO_PCT 25920
+#define MLD_TOTAL_ALLOC_87_KEYPAIR_PCT 32032
 #define MLD_TOTAL_ALLOC_87_PK_FROM_SK 41184
 #define MLD_TOTAL_ALLOC_87_SIGN 21344
 #define MLD_TOTAL_ALLOC_87_VERIFY 24768

mldsa/src/sign.c

@@ -364,19 +364,26 @@ int mld_sign_keypair(uint8_t pk[MLDSA_CRYPTO_PUBLICKEYBYTES],
                      uint8_t sk[MLDSA_CRYPTO_SECRETKEYBYTES],
                      MLD_CONFIG_CONTEXT_PARAMETER_TYPE context)
 {
-  MLD_ALIGN uint8_t seed[MLDSA_SEEDBYTES];
   int ret;
+  MLD_ALLOC(seed, uint8_t, MLDSA_SEEDBYTES, context);
+
+  if (seed == NULL)
+  {
+    ret = MLD_ERR_OUT_OF_MEMORY;
+    goto cleanup;
+  }
+
   if (mld_randombytes(seed, MLDSA_SEEDBYTES) != 0)
   {
     ret = MLD_ERR_RNG_FAIL;
     goto cleanup;
   }
-  MLD_CT_TESTING_SECRET(seed, sizeof(seed));
+  MLD_CT_TESTING_SECRET(seed, MLDSA_SEEDBYTES);
   ret = mld_sign_keypair_internal(pk, sk, seed, context);
 
 cleanup:
   /* @[FIPS204, Section 3.6.3] Destruction of intermediate values. */
-  mld_zeroize(seed, sizeof(seed));
+  MLD_FREE(seed, uint8_t, MLDSA_SEEDBYTES, context);
   return ret;
 }
 #endif /* !MLD_CONFIG_NO_RANDOMIZED_API */
@@ -983,8 +990,15 @@ int mld_sign_signature_extmu(uint8_t sig[MLDSA_CRYPTO_BYTES], size_t *siglen,
                              const uint8_t sk[MLDSA_CRYPTO_SECRETKEYBYTES],
                              MLD_CONFIG_CONTEXT_PARAMETER_TYPE context)
 {
-  MLD_ALIGN uint8_t rnd[MLDSA_RNDBYTES];
   int ret;
+  MLD_ALLOC(rnd, uint8_t, MLDSA_RNDBYTES, context);
+
+  if (rnd == NULL)
+  {
+    *siglen = 0;
+    ret = MLD_ERR_OUT_OF_MEMORY;
+    goto cleanup;
+  }
 
   /* Randomized variant of ML-DSA. If you need the deterministic variant,
    * call mld_sign_signature_internal directly with all-zero rnd. */
@@ -994,14 +1008,14 @@ int mld_sign_signature_extmu(uint8_t sig[MLDSA_CRYPTO_BYTES], size_t *siglen,
     ret = MLD_ERR_RNG_FAIL;
     goto cleanup;
   }
-  MLD_CT_TESTING_SECRET(rnd, sizeof(rnd));
+  MLD_CT_TESTING_SECRET(rnd, MLDSA_RNDBYTES);
 
   ret = mld_sign_signature_internal(sig, siglen, mu, MLDSA_CRHBYTES, NULL, 0,
                                     rnd, sk, 1, context);
 
 cleanup:
   /* @[FIPS204, Section 3.6.3] Destruction of intermediate values. */
-  mld_zeroize(rnd, sizeof(rnd));
+  MLD_FREE(rnd, uint8_t, MLDSA_RNDBYTES, context);
 
   return ret;
 }