Fixed SLH-DSA optRand not being populated by randomness

Author: royb

core/src/main/java/org/bouncycastle/pqc/crypto/slhdsa/HashSLHDSASigner.java

@@ -124,6 +124,14 @@ public byte[] generateSignature() throws CryptoException, DataLengthException
 
         // generate randomizer
         byte[] optRand = new byte[engine.N];
+        if (random != null)
+        {
+            random.nextBytes(optRand);
+        }
+        else
+        {
+            System.arraycopy(privKey.pk.seed, 0, optRand, 0, optRand.length);
+        }
         return internalGenerateSignature(ds_message, optRand);
     }
 
@@ -154,12 +162,6 @@ public byte[] internalGenerateSignature(byte[] message, byte[] optRand)
         SLHDSAEngine engine = privKey.getParameters().getEngine();
         engine.init(privKey.pk.seed);
 
-        if (optRand == null)
-        {
-            optRand = new byte[engine.N];
-            System.arraycopy(privKey.pk.seed, 0, optRand, 0, optRand.length);
-        }
-
         Fors fors = new Fors(engine);
         byte[] R = engine.PRF_msg(privKey.sk.prf, optRand, message);
 

core/src/main/java/org/bouncycastle/pqc/crypto/slhdsa/SLHDSASigner.java

@@ -95,6 +95,15 @@ public byte[] generateSignature(byte[] message)
 
         // generate randomizer
         byte[] optRand = new byte[engine.N];
+        if (random != null)
+        {
+            random.nextBytes(optRand);
+        }
+        else
+        {
+            System.arraycopy(privKey.pk.seed, 0, optRand, 0, optRand.length);
+        }
+
         return internalGenerateSignature(ds_message, optRand);
     }
 
@@ -159,12 +168,6 @@ public byte[] internalGenerateSignature(byte[] message, byte[] optRand)
         SLHDSAEngine engine = privKey.getParameters().getEngine();
         engine.init(privKey.pk.seed);
 
-        if (optRand == null)
-        {
-            optRand = new byte[engine.N];
-            System.arraycopy(privKey.pk.seed, 0, optRand, 0, optRand.length);
-        }
-
         Fors fors = new Fors(engine);
         byte[] R = engine.PRF_msg(privKey.sk.prf, optRand, message);
 

core/src/test/java/org/bouncycastle/pqc/crypto/test/SLHDSATest.java

@@ -146,15 +146,20 @@ public void testSigGenSingleFile() throws IOException
                         byte[] signature = Hex.decode((String) buf.get("signature"));
                         byte[] rnd = null;
 
-                        if (!deterministic)
-                        {
-                            rnd = Hex.decode((String) buf.get("additionalRandomness"));
-                        }
 
                         SLHDSAParameters parameters = parametersMap.get(buf.get("parameterSet"));
 
                         SLHDSAPrivateKeyParameters privParams = new SLHDSAPrivateKeyParameters(parameters, sk);
 
+                        if (!deterministic)
+                        {
+                            rnd = Hex.decode((String) buf.get("additionalRandomness"));
+                        }
+                        else
+                        {
+                            rnd = privParams.getPublicSeed();
+                        }
+
                         // sign
                         SLHDSASigner signer = new SLHDSASigner();
 
@@ -368,15 +373,22 @@ public void testSigGen() throws IOException
                         byte[] signature = Hex.decode((String) buf.get("signature"));
                         byte[] rnd = null;
 
-                        if (!deterministic)
-                        {
-                            rnd = Hex.decode((String) buf.get("additionalRandomness"));
-                        }
+
 
                         SLHDSAParameters parameters = params[fileIndex];
 
                         SLHDSAPrivateKeyParameters privParams = new SLHDSAPrivateKeyParameters(parameters, sk);
 
+
+                        if (!deterministic)
+                        {
+                            rnd = Hex.decode((String) buf.get("additionalRandomness"));
+                        }
+                        else
+                        {
+                            rnd = privParams.getPublicSeed();
+                        }
+
                         // sign
                         SLHDSASigner signer = new SLHDSASigner();