changes.patch

diff -ruaN unzip/Optimized_Implementation/include/csprng_hash.h tmp/Optimized_Implementation/include/csprng_hash.h
--- unzip/Optimized_Implementation/include/csprng_hash.h	2025-08-22 02:46:26.446223685 +0200
+++ tmp/Optimized_Implementation/include/csprng_hash.h	2025-08-22 00:30:43.455627803 +0200
@@ -34,6 +34,7 @@
 #ifndef CSPRNG_HASH_H
 #define CSPRNG_HASH_H
 
+#include "crypto_declassify.h"
 #include "parameters.h"
 #include "sha3.h"
 
@@ -271,6 +272,10 @@
             pos_remaining -= refresh_amount;
         }
         res[placed] = sub_buffer & mask;
+
+        /* SUPERCOP edit: tell TIMECOP to ignore non-constant-time behavior in rejection sampling. */
+        crypto_declassify(&res[placed], sizeof(FP_ELEM));
+
         if (res[placed] < P) {
            placed++;
         }
@@ -316,6 +321,10 @@
         }
         /* draw from 0 ... P-2, then add 1*/
         res[placed] = (sub_buffer & mask)+1;
+
+        /* SUPERCOP edit: tell TIMECOP to ignore non-constant-time behavior in rejection sampling. */
+        crypto_declassify(&res[placed], sizeof(FP_ELEM));
+
         if (res[placed] < P) {
            placed++;
         }
@@ -358,6 +367,11 @@
             pos_remaining -= refresh_amount;
         }
         *((FP_ELEM*)res+placed) = sub_buffer & mask;
+
+        /* SUPERCOP edit: tell TIMECOP to ignore non-constant-time behavior in rejection sampling. */
+        FP_ELEM *target = ((FP_ELEM*)res + placed);
+        crypto_declassify(target, sizeof(FP_ELEM));
+
         if (*((FP_ELEM*)res+placed) < P) {
            placed++;
         }
@@ -401,6 +415,10 @@
             pos_remaining -= refresh_amount;
         }
         res[placed] = sub_buffer & mask;
+
+        /* SUPERCOP edit: tell TIMECOP to ignore non-constant-time behavior in rejection sampling. */
+        crypto_declassify(&res[placed], sizeof(FZ_ELEM));
+
         if (res[placed] < Z) {
            placed++;
         }
@@ -443,6 +461,10 @@
             pos_remaining -= refresh_amount;
         }
         res[placed] = sub_buffer & mask;
+
+        /* SUPERCOP edit: tell TIMECOP to ignore non-constant-time behavior in rejection sampling. */
+        crypto_declassify(&res[placed], sizeof(FZ_ELEM));
+
         if (res[placed] < Z) {
            placed++;
         }
@@ -486,6 +508,11 @@
             pos_remaining -= refresh_amount;
         }
         *((FZ_ELEM*)res+placed) = sub_buffer & mask;
+
+        /* SUPERCOP edit: tell TIMECOP to ignore non-constant-time behavior in rejection sampling. */
+        FZ_ELEM *target = ((FZ_ELEM*)res + placed);
+        crypto_declassify(target, sizeof(FZ_ELEM));
+
         if (*((FZ_ELEM*)res+placed) < Z) {
            placed++;
         }
diff -ruaN unzip/Optimized_Implementation/include/fp_arith.h tmp/Optimized_Implementation/include/fp_arith.h
--- unzip/Optimized_Implementation/include/fp_arith.h	2025-08-22 02:46:26.446223685 +0200
+++ tmp/Optimized_Implementation/include/fp_arith.h	2025-08-22 02:47:18.674575661 +0200
@@ -472,7 +472,7 @@
     /* res: expand, align */
     alignas(32) FP_ELEM res_x[ROUND_UP(N,EPI16_PER_REG)];
     /* e: convert from uint8 to uint16, expand, align */
-    alignas(32) FP_ELEM e_x[ROUND_UP(N,EPI16_PER_REG)];
+    alignas(32) FP_ELEM e_x[ROUND_UP(N,EPI16_PER_REG)] = {0};
     for (int i = 0; i < N; i++) {
         e_x[i] = e[i];
     }
@@ -528,7 +528,7 @@
     /* res: expand, align */
     alignas(32) FP_ELEM res_x[ROUND_UP(N,EPI16_PER_REG)];
     /* in: convert from uint8 to uint16, expand, align */
-    alignas(32) FP_ELEM in_x[ROUND_UP(N,EPI16_PER_REG)];
+    alignas(32) FP_ELEM in_x[ROUND_UP(N,EPI16_PER_REG)] = {0};
     for (int i = 0; i < N; i++) {
         in_x[i] = in[i];
     }
diff -ruaN unzip/Optimized_Implementation/lib/CROSS.c tmp/Optimized_Implementation/lib/CROSS.c
--- unzip/Optimized_Implementation/lib/CROSS.c	2025-08-22 02:46:26.450223711 +0200
+++ tmp/Optimized_Implementation/lib/CROSS.c	2025-08-22 00:31:16.036579456 +0200
@@ -38,6 +38,7 @@
 #include "fp_arith.h"
 #include "merkle_tree.h"
 #include "pack_unpack.h"
+#include "randombytes.h"
 #include "seedtree.h"
 
 #if defined(RSDP)
diff -ruaN unzip/Reference_Implementation/include/api.h tmp/Reference_Implementation/include/api.h
--- unzip/Reference_Implementation/include/api.h	2025-08-22 02:46:26.450223711 +0200
+++ tmp/Reference_Implementation/include/api.h	2025-08-22 00:41:07.441952861 +0200
@@ -32,7 +32,7 @@
 
 #pragma once
 
-#include "CROSS.h"
+#include "CROSS_struct.h"
 #include "parameters.h"
 
 #define CRYPTO_ALGNAME "CROSS"
diff -ruaN unzip/Reference_Implementation/include/CROSS.h tmp/Reference_Implementation/include/CROSS.h
--- unzip/Reference_Implementation/include/CROSS.h	2025-08-22 02:46:26.450223711 +0200
+++ tmp/Reference_Implementation/include/CROSS.h	2025-08-22 00:41:48.618320272 +0200
@@ -33,49 +33,10 @@
 
 #include <stdint.h>
 
+#include "CROSS_struct.h"
 #include "pack_unpack.h"
 #include "parameters.h"
 
-/* Public key: the parity check matrix is shrunk to a seed, syndrome
- * represented in full */
-typedef struct {
-   uint8_t seed_pk[KEYPAIR_SEED_LENGTH_BYTES];
-   uint8_t s[DENSELY_PACKED_FP_SYN_SIZE];
-} pk_t;
-
-/* Private key: just a single seed*/
-typedef struct {
-   uint8_t seed_sk[KEYPAIR_SEED_LENGTH_BYTES];
-} sk_t;
-
-typedef struct {
-  uint8_t y[DENSELY_PACKED_FP_VEC_SIZE];
-#if defined(RSDP)
-  uint8_t v_bar[DENSELY_PACKED_FZ_VEC_SIZE];
-#elif defined(RSDPG)
-  uint8_t v_G_bar[DENSELY_PACKED_FZ_RSDP_G_VEC_SIZE];
-#endif
-} resp_0_t;
-
-/* Signature: */
-typedef struct {
-   uint8_t salt[SALT_LENGTH_BYTES];
-   uint8_t digest_cmt[HASH_DIGEST_LENGTH];
-   uint8_t digest_chall_2[HASH_DIGEST_LENGTH];
-#if defined(NO_TREES)   
-   uint8_t path[W*SEED_LENGTH_BYTES];
-   uint8_t proof[W*HASH_DIGEST_LENGTH];
-#else
-   /*Seed tree paths storage*/
-   uint8_t path[TREE_NODES_TO_STORE*SEED_LENGTH_BYTES];
-   /*Merkle tree proof field.*/
-   uint8_t proof[HASH_DIGEST_LENGTH*TREE_NODES_TO_STORE];
-#endif
-   uint8_t resp_1[T-W][HASH_DIGEST_LENGTH];
-   resp_0_t resp_0[T-W];
-} CROSS_sig_t;
-
-
 /* keygen cannot fail */
 void CROSS_keygen(sk_t *SK,
                  pk_t *PK);
diff -ruaN unzip/Reference_Implementation/include/CROSS_struct.h tmp/Reference_Implementation/include/CROSS_struct.h
--- unzip/Reference_Implementation/include/CROSS_struct.h	1970-01-01 01:00:00.000000000 +0100
+++ tmp/Reference_Implementation/include/CROSS_struct.h	2025-08-22 00:51:40.694344747 +0200
@@ -0,0 +1,47 @@
+#pragma once
+
+#include <stdint.h>
+
+#include "parameters.h"
+
+/* SUPERCOP edit: place struct definitions in a separate file so they can be 
+ * used in api.h without breaking namespacing */
+
+/* Public key: the parity check matrix is shrunk to a seed, syndrome
+ * represented in full */
+typedef struct {
+   uint8_t seed_pk[KEYPAIR_SEED_LENGTH_BYTES];
+   uint8_t s[DENSELY_PACKED_FP_SYN_SIZE];
+} pk_t;
+
+/* Private key: just a single seed*/
+typedef struct {
+   uint8_t seed_sk[KEYPAIR_SEED_LENGTH_BYTES];
+} sk_t;
+
+typedef struct {
+  uint8_t y[DENSELY_PACKED_FP_VEC_SIZE];
+#if defined(RSDP)
+  uint8_t v_bar[DENSELY_PACKED_FZ_VEC_SIZE];
+#elif defined(RSDPG)
+  uint8_t v_G_bar[DENSELY_PACKED_FZ_RSDP_G_VEC_SIZE];
+#endif
+} resp_0_t;
+
+/* Signature: */
+typedef struct {
+   uint8_t salt[SALT_LENGTH_BYTES];
+   uint8_t digest_cmt[HASH_DIGEST_LENGTH];
+   uint8_t digest_chall_2[HASH_DIGEST_LENGTH];
+#if defined(NO_TREES)   
+   uint8_t path[W*SEED_LENGTH_BYTES];
+   uint8_t proof[W*HASH_DIGEST_LENGTH];
+#else
+   /*Seed tree paths storage*/
+   uint8_t path[TREE_NODES_TO_STORE*SEED_LENGTH_BYTES];
+   /*Merkle tree proof field.*/
+   uint8_t proof[HASH_DIGEST_LENGTH*TREE_NODES_TO_STORE];
+#endif
+   uint8_t resp_1[T-W][HASH_DIGEST_LENGTH];
+   resp_0_t resp_0[T-W];
+} CROSS_sig_t;
\ No newline at end of file
diff -ruaN unzip/Reference_Implementation/include/csprng_hash.h tmp/Reference_Implementation/include/csprng_hash.h
--- unzip/Reference_Implementation/include/csprng_hash.h	2025-08-22 02:46:26.450223711 +0200
+++ tmp/Reference_Implementation/include/csprng_hash.h	2025-08-22 00:33:47.680655016 +0200
@@ -34,6 +34,7 @@
 #ifndef CSPRNG_HASH_H
 #define CSPRNG_HASH_H
 
+#include "crypto_declassify.h"
 #include "parameters.h"
 #include "sha3.h"
 
@@ -132,6 +133,10 @@
             pos_remaining -= refresh_amount;
         }
         res[placed] = sub_buffer & mask;
+
+        /* SUPERCOP edit: tell TIMECOP to ignore non-constant-time behavior in rejection sampling. */
+        crypto_declassify(&res[placed], sizeof(FP_ELEM));
+
         if (res[placed] < P) {
            placed++;
         }
@@ -177,6 +182,10 @@
         }
         /* draw from 0 ... P-2, then add 1*/
         res[placed] = (sub_buffer & mask)+1;
+
+        /* SUPERCOP edit: tell TIMECOP to ignore non-constant-time behavior in rejection sampling. */
+        crypto_declassify(&res[placed], sizeof(FP_ELEM));
+
         if (res[placed] < P) {
            placed++;
         }
@@ -219,6 +228,11 @@
             pos_remaining -= refresh_amount;
         }
         *((FP_ELEM*)res+placed) = sub_buffer & mask;
+
+        /* SUPERCOP edit: tell TIMECOP to ignore non-constant-time behavior in rejection sampling. */
+        FP_ELEM *target = ((FP_ELEM*)res + placed);
+        crypto_declassify(target, sizeof(FP_ELEM));
+
         if (*((FP_ELEM*)res+placed) < P) {
            placed++;
         }
@@ -262,6 +276,10 @@
             pos_remaining -= refresh_amount;
         }
         res[placed] = sub_buffer & mask;
+
+        /* SUPERCOP edit: tell TIMECOP to ignore non-constant-time behavior in rejection sampling. */
+        crypto_declassify(&res[placed], sizeof(FZ_ELEM));
+
         if (res[placed] < Z) {
            placed++;
         }
@@ -304,6 +322,10 @@
             pos_remaining -= refresh_amount;
         }
         res[placed] = sub_buffer & mask;
+
+        /* SUPERCOP edit: tell TIMECOP to ignore non-constant-time behavior in rejection sampling. */
+        crypto_declassify(&res[placed], sizeof(FZ_ELEM));
+
         if (res[placed] < Z) {
            placed++;
         }
@@ -347,6 +369,11 @@
             pos_remaining -= refresh_amount;
         }
         *((FZ_ELEM*)res+placed) = sub_buffer & mask;
+
+        /* SUPERCOP edit: tell TIMECOP to ignore non-constant-time behavior in rejection sampling. */
+        FZ_ELEM *target = ((FZ_ELEM*)res + placed);
+        crypto_declassify(target, sizeof(FZ_ELEM));
+
         if (*((FZ_ELEM*)res+placed) < Z) {
            placed++;
         }
diff -ruaN unzip/Reference_Implementation/lib/CROSS.c tmp/Reference_Implementation/lib/CROSS.c
--- unzip/Reference_Implementation/lib/CROSS.c	2025-08-22 02:46:26.454223739 +0200
+++ tmp/Reference_Implementation/lib/CROSS.c	2025-08-22 00:34:09.289199532 +0200
@@ -38,6 +38,7 @@
 #include "fp_arith.h"
 #include "merkle_tree.h"
 #include "pack_unpack.h"
+#include "randombytes.h"
 #include "seedtree.h"
 
 #if defined(RSDP)
diff -ruaN unzip/Reference_Implementation/lib/csprng_hash.c tmp/Reference_Implementation/lib/csprng_hash.c
--- unzip/Reference_Implementation/lib/csprng_hash.c	2025-08-22 02:46:26.454223739 +0200
+++ tmp/Reference_Implementation/lib/csprng_hash.c	2025-08-22 00:35:10.610708869 +0200
@@ -79,6 +79,10 @@
         int bits_for_pos = BITS_TO_REPRESENT(T-1-curr);
         uint64_t pos_mask = ( (uint64_t) 1 <<  bits_for_pos) - 1;
         uint16_t candidate_pos = (sub_buffer & pos_mask);
+
+        /* SUPERCOP edit: tell TIMECOP to ignore non-constant-time behavior in rejection sampling. */
+        crypto_declassify(&candidate_pos, sizeof(uint16_t));
+
         if (candidate_pos < T-curr) {
             int dest = curr+candidate_pos;
             /* the position is admissible, swap */
diff -ruaN unzip/Reference_Implementation/lib/pack_unpack.c tmp/Reference_Implementation/lib/pack_unpack.c
--- unzip/Reference_Implementation/lib/pack_unpack.c	2025-08-22 02:46:26.454223739 +0200
+++ tmp/Reference_Implementation/lib/pack_unpack.c	2025-08-22 00:37:58.358639143 +0200
@@ -36,6 +36,9 @@
 
 /*Implementation of packing and unpacking of 3/7/9 bit elements into byte vectors*/
 
+/* SUPERCOP edit: generic_pack_3_bit is unused in RSDPG */
+#if Z == 7
+
 /*
  * generic_pack_3_bit()
  *
@@ -100,6 +103,8 @@
   }
 }
 
+#endif
+
 /*
  * generic_pack_7_bit()
  *
@@ -182,6 +187,9 @@
   }
 }
 
+/* SUPERCOP edit: generic_pack_9_bit is unused in RSDP */
+#if P == 509
+
 /*
  * generic_pack_9_bit()
  *
@@ -273,6 +281,8 @@
   }
 }
 
+#endif
+
 /*
  * generic_pack_fp()
  *
@@ -324,6 +334,9 @@
 #endif
 }
 
+/* SUPERCOP edit: generic_unpack_3_bit is unused in RSDPG */
+#if Z == 7
+
 /*
  * generic_unpack_3_bit()
  *
@@ -414,6 +427,8 @@
   return is_packed_padd_ok;
 }
 
+#endif
+
 /*
  * generic_unpack_7_bit()
  *
@@ -504,6 +519,9 @@
   return is_packed_padd_ok;
 }
 
+/* SUPERCOP edit: generic_unpack_9_bit is unused in RSDP */
+#if P == 509
+
 /*
  * generic_unpack_9_bit()
  *
@@ -594,6 +612,8 @@
   return is_packed_padd_ok;
 }
 
+#endif
+
 /*
  * generic_unpack_fp()
  *
diff -ruaN unzip/Reference_Implementation/lib/sign.c tmp/Reference_Implementation/lib/sign.c
--- unzip/Reference_Implementation/lib/sign.c	2025-08-22 02:46:26.454223739 +0200
+++ tmp/Reference_Implementation/lib/sign.c	2025-08-22 00:48:45.627579006 +0200
@@ -33,6 +33,7 @@
 #include <string.h>  // memcpy
 
 #include "api.h"
+#include "CROSS.h"
 
 /*----------------------------------------------------------------------------*/
 
@@ -77,14 +78,18 @@
                      unsigned long long *mlen,                  // out parameter
                      const unsigned char *sm,                   // in parameter
                      unsigned long long smlen,                  // in parameter
-                     const unsigned char *pk)                   // in parameter
+                     const unsigned char *pk_static)            // in parameter
 {
 
+   /* SUPERCOP edit: make a static copy of the public key */
+   const pk_t pk;
+   memcpy((unsigned char *) &pk, pk_static, sizeof(pk_t));
+
    /* verify returns 1 if signature is ok, 0 otherwise */
    *mlen = smlen-(unsigned long long) sizeof(CROSS_sig_t);
    
    memcpy((unsigned char *) m, (const unsigned char *) sm, (size_t) *mlen);
-   int ok = CROSS_verify((const pk_t *const) pk,            // in parameter
+   int ok = CROSS_verify(&pk,                                   // in parameter
                         (const char *const) m,                  // in parameter
                         (const uint64_t) *mlen,                 // in parameter
                         (const CROSS_sig_t * const) (sm+*mlen));// in parameter