Skip to content

Commit 7c3ac3c

Browse files
mkannwischermkannwischer
committed
CI: Test config variation optblocker (i.e., no inline asm barrier)
This commit adds a config variation test to CI to test the alternative constant time functions (when no inline asm is available). To do so, first a MLD_CONFIG_FILE configuration option is introduced allowing to define a custom configurtion file. This option is then used in a workflow to include a config that has MLD_CONFIG_NO_ASM set. Signed-off-by: Matthias J. Kannwischer <[email protected]>
1 parent ad29f04 commit 7c3ac3c

File tree

5 files changed

+227
-2
lines changed

5 files changed

+227
-2
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -353,7 +353,42 @@ jobs:
353353
acvp: false
354354
examples: false
355355
stack: true
356-
356+
config_variations:
357+
name: Non-standard configurations
358+
strategy:
359+
fail-fast: false
360+
matrix:
361+
external:
362+
- ${{ github.repository_owner != 'pq-code-package' }}
363+
target:
364+
- runner: pqcp-arm64
365+
name: 'ubuntu-latest (aarch64)'
366+
- runner: pqcp-x64
367+
name: 'ubuntu-latest (x86_64)'
368+
exclude:
369+
- {external: true,
370+
target: {
371+
runner: pqcp-arm64,
372+
name: 'ubuntu-latest (aarch64)',
373+
}}
374+
- {external: true,
375+
target: {
376+
runner: pqcp-x64,
377+
name: 'ubuntu-latest (x86_64)',
378+
}}
379+
runs-on: ${{ matrix.target.runner }}
380+
steps:
381+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
382+
- name: "No ASM"
383+
uses: ./.github/actions/multi-functest
384+
with:
385+
gh_token: ${{ secrets.GITHUB_TOKEN }}
386+
compile_mode: native
387+
cflags: "-std=c11 -D_GNU_SOURCE -DMLD_CONFIG_FILE=\\\\\\\"../test/no_asm_config.h\\\\\\\" -fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all"
388+
func: true
389+
kat: true
390+
acvp: true
391+
examples: false # Some examples use a custom config themselves
357392
check_autogenerated_files:
358393
strategy:
359394
fail-fast: false

‎mldsa/common.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,12 @@
66
#ifndef MLD_COMMON_H
77
#define MLD_COMMON_H
88

9+
#if defined(MLD_CONFIG_FILE)
10+
#include MLD_CONFIG_FILE
11+
#else
12+
#include "config.h"
13+
#endif
14+
915
#include "cbmc.h"
1016
#include "params.h"
1117
#include "sys.h"

‎mldsa/config.h‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,25 @@
2222
#define MLD_NAMESPACE(s) MLD_87_ref_##s
2323
#endif
2424

25+
26+
/******************************************************************************
27+
* Name: MLD_CONFIG_FILE
28+
*
29+
* Description: If defined, this is a header that will be included instead
30+
* of this default configuration file mldsa/config.h.
31+
*
32+
* When you need to build mldsa-native in multiple configurations,
33+
* using varying MLD_CONFIG_FILE can be more convenient
34+
* then configuring everything through CFLAGS.
35+
*
36+
* To use, MLD_CONFIG_FILE _must_ be defined prior
37+
* to the inclusion of any mldsa-native headers. For example,
38+
* it can be set by passing `-DMLD_CONFIG_FILE="..."`
39+
* on the command line.
40+
*
41+
*****************************************************************************/
42+
/* #define MLD_CONFIG_FILE "config.h" */
43+
2544
/******************************************************************************
2645
* Name: MLD_CONFIG_ARITH_BACKEND_FILE
2746
*

‎mldsa/params.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
#ifndef MLD_PARAMS_H
66
#define MLD_PARAMS_H
77

8-
#include "config.h"
8+
#include "common.h"
99

1010
#define MLDSA_SEEDBYTES 32
1111
#define MLDSA_CRHBYTES 64

‎test/no_asm_config.h‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
/*
2+
* Copyright (c) The mldsa-native project authors
3+
* SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
4+
*/
5+
#ifndef MLD_CONFIG_H
6+
#define MLD_CONFIG_H
7+
8+
#define MLD_RANDOMIZED_SIGNING
9+
10+
#ifndef MLDSA_MODE
11+
#define MLDSA_MODE 2
12+
#endif
13+
14+
#if MLDSA_MODE == 2
15+
#define MLD_NAMESPACETOP MLD_44_ref
16+
#define MLD_NAMESPACE(s) MLD_44_ref_##s
17+
#elif MLDSA_MODE == 3
18+
#define MLD_NAMESPACETOP MLD_65_ref
19+
#define MLD_NAMESPACE(s) MLD_65_ref_##s
20+
#elif MLDSA_MODE == 5
21+
#define MLD_NAMESPACETOP MLD_87_ref
22+
#define MLD_NAMESPACE(s) MLD_87_ref_##s
23+
#endif
24+
25+
/******************************************************************************
26+
* Name: MLD_CONFIG_ARITH_BACKEND_FILE
27+
*
28+
* Description: The arithmetic backend to use.
29+
*
30+
* If MLD_CONFIG_USE_NATIVE_BACKEND_ARITH is unset, this option
31+
* is ignored.
32+
*
33+
* If MLD_CONFIG_USE_NATIVE_BACKEND_ARITH is set, this option must
34+
* either be undefined or the filename of an arithmetic backend.
35+
* If unset, the default backend will be used.
36+
*
37+
* This can be set using CFLAGS.
38+
*
39+
*****************************************************************************/
40+
#if defined(MLD_CONFIG_USE_NATIVE_BACKEND_ARITH) && \
41+
!defined(MLD_CONFIG_ARITH_BACKEND_FILE)
42+
#define MLD_CONFIG_ARITH_BACKEND_FILE "native/meta.h"
43+
#endif
44+
45+
/******************************************************************************
46+
* Name: MLD_CONFIG_FIPS202_BACKEND_FILE
47+
*
48+
* Description: The FIPS-202 backend to use.
49+
*
50+
* If MLD_CONFIG_USE_NATIVE_BACKEND_FIPS202 is set, this option
51+
* must either be undefined or the filename of a FIPS202 backend.
52+
* If unset, the default backend will be used.
53+
*
54+
* This can be set using CFLAGS.
55+
*
56+
*****************************************************************************/
57+
#if defined(MLD_CONFIG_USE_NATIVE_BACKEND_FIPS202) && \
58+
!defined(MLD_CONFIG_FIPS202_BACKEND_FILE)
59+
#define MLD_CONFIG_FIPS202_BACKEND_FILE "fips202/native/auto.h"
60+
#endif
61+
62+
/******************************************************************************
63+
* Name: MLD_CONFIG_CUSTOM_ZEROIZE
64+
*
65+
* Description: In compliance with FIPS 204 Section 3.6.3, mldsa-native zeroizes
66+
* intermediate stack buffers before returning from function calls.
67+
*
68+
* Set this option and define `mld_zeroize_native` if you want to
69+
* use a custom method to zeroize intermediate stack buffers.
70+
* The default implementation uses SecureZeroMemory on Windows
71+
* and a memset + compiler barrier otherwise. If neither of those
72+
* is available on the target platform, compilation will fail,
73+
* and you will need to use MLD_CONFIG_CUSTOM_ZEROIZE to provide
74+
* a custom implementation of `mld_zeroize_native()`.
75+
*
76+
* WARNING:
77+
* The explicit stack zeroization conducted by mldsa-native
78+
* reduces the likelihood of data leaking on the stack, but
79+
* does not eliminate it! The C standard makes no guarantee about
80+
* where a compiler allocates structures and whether/where it makes
81+
* copies of them. Also, in addition to entire structures, there
82+
* may also be potentially exploitable leakage of individual values
83+
* on the stack.
84+
*
85+
* If you need bullet-proof zeroization of the stack, you need to
86+
* consider additional measures instead of what this feature
87+
* provides. In this case, you can set mld_zeroize_native to a
88+
* no-op.
89+
*
90+
*****************************************************************************/
91+
#define MLD_CONFIG_CUSTOM_ZEROIZE
92+
#if !defined(__ASSEMBLER__)
93+
#include <stdint.h>
94+
#include <string.h>
95+
#include "../mldsa/sys.h"
96+
static MLD_INLINE void mld_zeroize_native(void *ptr, size_t len)
97+
{
98+
explicit_bzero(ptr, len);
99+
}
100+
#endif
101+
102+
103+
/******************************************************************************
104+
* Name: MLD_CONFIG_KEYGEN_PCT
105+
*
106+
* Description: Compliance with @[FIPS140_3_IG, p.87] requires a
107+
* Pairwise Consistency Test (PCT) to be carried out on a freshly
108+
* generated keypair before it can be exported.
109+
*
110+
* Set this option if such a check should be implemented.
111+
* In this case, crypto_sign_keypair_internal and
112+
* crypto_sign_keypair will return a non-zero error code if the
113+
* PCT failed.
114+
*
115+
* NOTE: This feature will drastically lower the performance of
116+
* key generation.
117+
*
118+
*****************************************************************************/
119+
/* #define MLD_CONFIG_KEYGEN_PCT */
120+
121+
/******************************************************************************
122+
* Name: MLD_CONFIG_KEYGEN_PCT_BREAKAGE_TEST
123+
*
124+
* Description: If this option is set, the user must provide a runtime
125+
* function `static inline int mld_break_pct() { ... }` to
126+
* indicate whether the PCT should be made fail.
127+
*
128+
* This option only has an effect if MLD_CONFIG_KEYGEN_PCT is set.
129+
*
130+
*****************************************************************************/
131+
/* #define MLD_CONFIG_KEYGEN_PCT_BREAKAGE_TEST
132+
#if !defined(__ASSEMBLER__)
133+
#include "sys.h"
134+
static MLD_INLINE int mld_break_pct(void)
135+
{
136+
... return 0/1 depending on whether PCT should be broken ...
137+
}
138+
#endif
139+
*/
140+
141+
/******************************************************************************
142+
* Name: MLD_CONFIG_NO_ASM
143+
*
144+
* Description: If this option is set, mldsa-native will be built without
145+
* use of native code or inline assembly.
146+
*
147+
* By default, inline assembly is used to implement value barriers.
148+
* Without inline assembly, mldsa-native will use a global volatile
149+
* 'opt blocker' instead; see ct.h.
150+
*
151+
* Inline assembly is also used to implement a secure zeroization
152+
* function on non-Windows platforms. If this option is set and
153+
* the target platform is not Windows, you MUST set
154+
* MLK_CONFIG_CUSTOM_ZEROIZE and provide a custom zeroization
155+
* function.
156+
*
157+
* If this option is set, MLD_CONFIG_USE_NATIVE_BACKEND_FIPS202 and
158+
* and MLD_CONFIG_USE_NATIVE_BACKEND_ARITH will be ignored, and no
159+
* native backends will be used.
160+
*
161+
*****************************************************************************/
162+
#define MLD_CONFIG_NO_ASM
163+
164+
165+
#endif /* !MLD_CONFIG_H */

0 commit comments

Comments
 (0)