@@ -119,8 +119,8 @@ static int mld_check_pct(uint8_t const pk[MLDSA_CRYPTO_PUBLICKEYBYTES],
119119
120120cleanup :
121121 /* @[FIPS204, Section 3.6.3] Destruction of intermediate values. */
122- MLD_FREE (signature , uint8_t , MLDSA_CRYPTO_BYTES );
123122 MLD_FREE (pk_test , uint8_t , MLDSA_CRYPTO_PUBLICKEYBYTES );
123+ MLD_FREE (signature , uint8_t , MLDSA_CRYPTO_BYTES );
124124
125125 return ret ;
126126}
@@ -274,9 +274,9 @@ __contract__(
274274
275275cleanup :
276276 /* @[FIPS204, Section 3.6.3] Destruction of intermediate values. */
277- MLD_FREE (mat , mld_polymat , 1 );
278- MLD_FREE (s1hat , mld_polyvecl , 1 );
279277 MLD_FREE (t , mld_polyveck , 1 );
278+ MLD_FREE (s1hat , mld_polyvecl , 1 );
279+ MLD_FREE (mat , mld_polymat , 1 );
280280 return ret ;
281281}
282282
@@ -332,19 +332,24 @@ int crypto_sign_keypair_internal(uint8_t pk[MLDSA_CRYPTO_PUBLICKEYBYTES],
332332 /* Constant time: pk is the public key, inherently public data */
333333 MLD_CT_TESTING_DECLASSIFY (pk , MLDSA_CRYPTO_PUBLICKEYBYTES );
334334
335- /* Pairwise Consistency Test (PCT) @[FIPS140_3_IG, p.87] */
336- ret = mld_check_pct (pk , sk );
337-
338335cleanup :
339336 /* @[FIPS204, Section 3.6.3] Destruction of intermediate values. */
340- MLD_FREE (seedbuf , uint8_t , 2 * MLDSA_SEEDBYTES + MLDSA_CRHBYTES );
341- MLD_FREE (inbuf , uint8_t , MLDSA_SEEDBYTES + 2 );
342- MLD_FREE (tr , uint8_t , MLDSA_TRBYTES );
343- MLD_FREE (s1 , mld_polyvecl , 1 );
344- MLD_FREE (s2 , mld_polyveck , 1 );
345- MLD_FREE (t1 , mld_polyveck , 1 );
346337 MLD_FREE (t0 , mld_polyveck , 1 );
347- return ret ;
338+ MLD_FREE (t1 , mld_polyveck , 1 );
339+ MLD_FREE (s2 , mld_polyveck , 1 );
340+ MLD_FREE (s1 , mld_polyvecl , 1 );
341+ MLD_FREE (tr , uint8_t , MLDSA_TRBYTES );
342+ MLD_FREE (inbuf , uint8_t , MLDSA_SEEDBYTES + 2 );
343+ MLD_FREE (seedbuf , uint8_t , 2 * MLDSA_SEEDBYTES + MLDSA_CRHBYTES );
344+
345+ if (ret != 0 )
346+ {
347+ return ret ;
348+ }
349+
350+ /* Pairwise Consistency Test (PCT) @[FIPS140_3_IG, p.87] */
351+ /* Do this after freeing all temporaries. */
352+ return mld_check_pct (pk , sk );
348353}
349354
350355#if !defined(MLD_CONFIG_NO_RANDOMIZED_API )
@@ -610,13 +615,13 @@ __contract__(
610615
611616cleanup :
612617 /* @[FIPS204, Section 3.6.3] Destruction of intermediate values. */
613- MLD_FREE (challenge_bytes , uint8_t , MLDSA_CTILDEBYTES );
614- MLD_FREE (y , mld_polyvecl , 1 );
615- MLD_FREE (z , mld_polyvecl , 1 );
616- MLD_FREE (w1 , mld_polyveck , 1 );
617- MLD_FREE (w0 , mld_polyveck , 1 );
618- MLD_FREE (h , mld_polyveck , 1 );
619618 MLD_FREE (cp , mld_poly , 1 );
619+ MLD_FREE (h , mld_polyveck , 1 );
620+ MLD_FREE (w0 , mld_polyveck , 1 );
621+ MLD_FREE (w1 , mld_polyveck , 1 );
622+ MLD_FREE (z , mld_polyvecl , 1 );
623+ MLD_FREE (y , mld_polyvecl , 1 );
624+ MLD_FREE (challenge_bytes , uint8_t , MLDSA_CTILDEBYTES );
620625
621626 return res ;
622627}
@@ -735,12 +740,12 @@ int crypto_sign_signature_internal(
735740 }
736741
737742 /* @[FIPS204, Section 3.6.3] Destruction of intermediate values. */
738- MLD_FREE (seedbuf , uint8_t ,
739- 2 * MLDSA_SEEDBYTES + MLDSA_TRBYTES + 2 * MLDSA_CRHBYTES );
740- MLD_FREE (mat , mld_polymat , 1 );
741- MLD_FREE (s1 , mld_polyvecl , 1 );
742743 MLD_FREE (s2 , mld_polyveck , 1 );
743744 MLD_FREE (t0 , mld_polyveck , 1 );
745+ MLD_FREE (s1 , mld_polyvecl , 1 );
746+ MLD_FREE (mat , mld_polymat , 1 );
747+ MLD_FREE (seedbuf , uint8_t ,
748+ 2 * MLDSA_SEEDBYTES + MLDSA_TRBYTES + 2 * MLDSA_CRHBYTES );
744749 return ret ;
745750}
746751
@@ -794,8 +799,8 @@ int crypto_sign_signature(uint8_t sig[MLDSA_CRYPTO_BYTES], size_t *siglen,
794799 }
795800
796801 /* @[FIPS204, Section 3.6.3] Destruction of intermediate values. */
797- MLD_FREE (pre , uint8_t , MLD_DOMAIN_SEPARATION_MAX_BYTES );
798802 MLD_FREE (rnd , uint8_t , MLDSA_RNDBYTES );
803+ MLD_FREE (pre , uint8_t , MLD_DOMAIN_SEPARATION_MAX_BYTES );
799804
800805 return ret ;
801806}
@@ -971,18 +976,18 @@ int crypto_sign_verify_internal(const uint8_t *sig, size_t siglen,
971976
972977cleanup :
973978 /* @[FIPS204, Section 3.6.3] Destruction of intermediate values. */
974- MLD_FREE (buf , uint8_t , (MLDSA_K * MLDSA_POLYW1_PACKEDBYTES ));
975- MLD_FREE (rho , uint8_t , MLDSA_SEEDBYTES );
976- MLD_FREE (mu , uint8_t , MLDSA_CRHBYTES );
977- MLD_FREE (c , uint8_t , MLDSA_CTILDEBYTES );
978- MLD_FREE (c2 , uint8_t , MLDSA_CTILDEBYTES );
979- MLD_FREE (cp , mld_poly , 1 );
980- MLD_FREE (mat , mld_polymat , 1 );
981- MLD_FREE (z , mld_polyvecl , 1 );
982- MLD_FREE (t1 , mld_polyveck , 1 );
983- MLD_FREE (w1 , mld_polyveck , 1 );
984- MLD_FREE (tmp , mld_polyveck , 1 );
985979 MLD_FREE (h , mld_polyveck , 1 );
980+ MLD_FREE (tmp , mld_polyveck , 1 );
981+ MLD_FREE (w1 , mld_polyveck , 1 );
982+ MLD_FREE (t1 , mld_polyveck , 1 );
983+ MLD_FREE (z , mld_polyvecl , 1 );
984+ MLD_FREE (mat , mld_polymat , 1 );
985+ MLD_FREE (cp , mld_poly , 1 );
986+ MLD_FREE (c2 , uint8_t , MLDSA_CTILDEBYTES );
987+ MLD_FREE (c , uint8_t , MLDSA_CTILDEBYTES );
988+ MLD_FREE (mu , uint8_t , MLDSA_CRHBYTES );
989+ MLD_FREE (rho , uint8_t , MLDSA_SEEDBYTES );
990+ MLD_FREE (buf , uint8_t , (MLDSA_K * MLDSA_POLYW1_PACKEDBYTES ));
986991 return res ;
987992}
988993
@@ -1349,15 +1354,15 @@ int crypto_sign_pk_from_sk(uint8_t pk[MLDSA_CRYPTO_PUBLICKEYBYTES],
13491354
13501355cleanup :
13511356 /* @[FIPS204, Section 3.6.3] Destruction of intermediate values. */
1352- MLD_FREE (rho , uint8_t , MLDSA_SEEDBYTES );
1353- MLD_FREE (tr , uint8_t , MLDSA_TRBYTES );
1354- MLD_FREE (tr_computed , uint8_t , MLDSA_TRBYTES );
1355- MLD_FREE (key , uint8_t , MLDSA_SEEDBYTES );
1356- MLD_FREE (s1 , mld_polyvecl , 1 );
1357- MLD_FREE (s2 , mld_polyveck , 1 );
1358- MLD_FREE (t0 , mld_polyveck , 1 );
1359- MLD_FREE (t0_computed , mld_polyveck , 1 );
13601357 MLD_FREE (t1 , mld_polyveck , 1 );
1358+ MLD_FREE (t0_computed , mld_polyveck , 1 );
1359+ MLD_FREE (t0 , mld_polyveck , 1 );
1360+ MLD_FREE (s2 , mld_polyveck , 1 );
1361+ MLD_FREE (s1 , mld_polyvecl , 1 );
1362+ MLD_FREE (key , uint8_t , MLDSA_SEEDBYTES );
1363+ MLD_FREE (tr_computed , uint8_t , MLDSA_TRBYTES );
1364+ MLD_FREE (tr , uint8_t , MLDSA_TRBYTES );
1365+ MLD_FREE (rho , uint8_t , MLDSA_SEEDBYTES );
13611366
13621367 return ret ;
13631368}
0 commit comments