wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-30 18:57:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Kyber: fix kyber_from_msg()

Browse Source 
New compilers with specific optimization levels will produce
non-constant time code for kyber_from_msg().
Add in an optimization blocker that stops the compiler from assuming
anything about the value to be ANDed with KYBER_Q_1_HALF.
This commit is contained in:
Sean Parkinson
2024-06-04 22:20:22 +10:00
parent b8aec63e14
commit df44face56
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
wolfcrypt/src/wc_kyber.c
View File

@ -59,6 +59,11 @@
/******************************************************************************/ /******************************************************************************/
/* Declare variable to make compiler not optimize code in kyber_from_msg(). */
volatile sword16 kyber_opt_blocker = 0;
/******************************************************************************/
/** /**
* Initialize the Kyber key. * Initialize the Kyber key.
* *

8
wolfcrypt/src/wc_kyber_poly.c
View File

@ -34,6 +34,9 @@
#ifdef WOLFSSL_WC_KYBER #ifdef WOLFSSL_WC_KYBER
/* Declared in wc_kyber.c to stop compiler optimizer from simplifying. */
extern volatile sword16 kyber_opt_blocker;
#ifdef USE_INTEL_SPEEDUP #ifdef USE_INTEL_SPEEDUP
static word32 cpuid_flags = 0; static word32 cpuid_flags = 0;
#endif #endif
@ -2773,6 +2776,8 @@ void kyber_decompress_5(sword16* p, const unsigned char* b)
/* Convert bit from byte to 0 or (KYBER_Q + 1) / 2. /* Convert bit from byte to 0 or (KYBER_Q + 1) / 2.
* *
* Constant time implementation. * Constant time implementation.
* XOR in kyber_opt_blocker to ensure optimizer doesn't know what will be ANDed
* with KYBER_Q_1_HALF and can't optimize to non-constant time code.
* *
* @param [out] p Polynomial to hold converted value. * @param [out] p Polynomial to hold converted value.
* @param [in] msg Message to get bit from byte from. * @param [in] msg Message to get bit from byte from.
@ -2780,7 +2785,8 @@ void kyber_decompress_5(sword16* p, const unsigned char* b)
* @param [in] j Index of bit in byte. * @param [in] j Index of bit in byte.
*/ */
#define FROM_MSG_BIT(p, msg, i, j) \ #define FROM_MSG_BIT(p, msg, i, j) \
p[8 * (i) + (j)] = ((sword16)0 - (sword16)(((msg)[i] >> (j)) & 1)) & KYBER_Q_1_HALF (p)[8 * (i) + (j)] = (((sword16)0 - (sword16)(((msg)[i] >> (j)) & 1)) ^ \
kyber_opt_blocker) & KYBER_Q_1_HALF
/* Convert message to polynomial. /* Convert message to polynomial.
* *