Merge pull request #434 from pq-code-package/cleanup-attempt_signature_generation

Clean up `mld_attempt_signature_generation`

Author: mkannwischer

mldsa/sign.c

@@ -319,24 +319,25 @@ __contract__(
   uint8_t challenge_bytes[MLDSA_CTILDEBYTES];
   unsigned int n;
   mld_polyvecl y, z;
-  mld_polyveck w2, w1, w0, h;
+  mld_polyveck w, w1, w0, h;
   mld_poly cp;
   uint32_t z_invalid, w0_invalid, h_invalid;
+  int res;
 
   /* Sample intermediate vector y */
   mld_polyvecl_uniform_gamma1(&y, rhoprime, nonce);
 
   /* Matrix-vector multiplication */
   z = y;
   mld_polyvecl_ntt(&z);
-  mld_polyvec_matrix_pointwise_montgomery(&w1, mat, &z);
-  mld_polyveck_reduce(&w1);
-  mld_polyveck_invntt_tomont(&w1);
+  mld_polyvec_matrix_pointwise_montgomery(&w, mat, &z);
+  mld_polyveck_reduce(&w);
+  mld_polyveck_invntt_tomont(&w);
 
   /* Decompose w and call the random oracle */
-  mld_polyveck_caddq(&w1);
-  mld_polyveck_decompose(&w2, &w0, &w1);
-  mld_polyveck_pack_w1(sig, &w2);
+  mld_polyveck_caddq(&w);
+  mld_polyveck_decompose(&w1, &w0, &w);
+  mld_polyveck_pack_w1(sig, &w1);
 
   mld_H(challenge_bytes, MLDSA_CTILDEBYTES, mu, MLDSA_CRHBYTES, sig,
         MLDSA_K * MLDSA_POLYW1_PACKEDBYTES, NULL, 0);
@@ -363,16 +364,8 @@ __contract__(
   MLD_CT_TESTING_DECLASSIFY(&z_invalid, sizeof(uint32_t));
   if (z_invalid)
   {
-    /* FIPS 204. Section 3.6.3 Destruction of intermediate values. */
-    mld_zeroize(challenge_bytes, MLDSA_CTILDEBYTES);
-    mld_zeroize(&y, sizeof(y));
-    mld_zeroize(&z, sizeof(z));
-    mld_zeroize(&w2, sizeof(w2));
-    mld_zeroize(&w1, sizeof(w1));
-    mld_zeroize(&w0, sizeof(w0));
-    mld_zeroize(&h, sizeof(h));
-    mld_zeroize(&cp, sizeof(cp));
-    return -1; /* reject */
+    res = -1; /* reject */
+    goto cleanup;
   }
 
   /* If z is valid, then its coefficients are bounded by  */
@@ -394,16 +387,8 @@ __contract__(
   MLD_CT_TESTING_DECLASSIFY(&w0_invalid, sizeof(uint32_t));
   if (w0_invalid)
   {
-    /* FIPS 204. Section 3.6.3 Destruction of intermediate values. */
-    mld_zeroize(challenge_bytes, sizeof(challenge_bytes));
-    mld_zeroize(&y, sizeof(y));
-    mld_zeroize(&z, sizeof(z));
-    mld_zeroize(&w2, sizeof(w2));
-    mld_zeroize(&w1, sizeof(w1));
-    mld_zeroize(&w0, sizeof(w0));
-    mld_zeroize(&h, sizeof(h));
-    mld_zeroize(&cp, sizeof(cp));
-    return -1; /* reject */
+    res = -1; /* reject */
+    goto cleanup;
   }
 
   /* Compute hints for w1 */
@@ -416,16 +401,8 @@ __contract__(
   MLD_CT_TESTING_DECLASSIFY(&h_invalid, sizeof(uint32_t));
   if (h_invalid)
   {
-    /* FIPS 204. Section 3.6.3 Destruction of intermediate values. */
-    mld_zeroize(challenge_bytes, MLDSA_CTILDEBYTES);
-    mld_zeroize(&y, sizeof(y));
-    mld_zeroize(&z, sizeof(z));
-    mld_zeroize(&w2, sizeof(w2));
-    mld_zeroize(&w1, sizeof(w1));
-    mld_zeroize(&w0, sizeof(w0));
-    mld_zeroize(&h, sizeof(h));
-    mld_zeroize(&cp, sizeof(cp));
-    return -1; /* reject */
+    res = -1; /* reject */
+    goto cleanup;
   }
 
   mld_polyveck_add(&w0, &h);
@@ -439,20 +416,12 @@ __contract__(
    * For a more detailed discussion, refer to https://eprint.iacr.org/2022/1406.
    */
   MLD_CT_TESTING_DECLASSIFY(&w0, sizeof(w0));
-  MLD_CT_TESTING_DECLASSIFY(&w2, sizeof(w2));
-  n = mld_polyveck_make_hint(&h, &w0, &w2);
+  MLD_CT_TESTING_DECLASSIFY(&w1, sizeof(w1));
+  n = mld_polyveck_make_hint(&h, &w0, &w1);
   if (n > MLDSA_OMEGA)
   {
-    /* FIPS 204. Section 3.6.3 Destruction of intermediate values. */
-    mld_zeroize(challenge_bytes, MLDSA_CTILDEBYTES);
-    mld_zeroize(&y, sizeof(y));
-    mld_zeroize(&z, sizeof(z));
-    mld_zeroize(&w2, sizeof(w2));
-    mld_zeroize(&w1, sizeof(w1));
-    mld_zeroize(&w0, sizeof(w0));
-    mld_zeroize(&h, sizeof(h));
-    mld_zeroize(&cp, sizeof(cp));
-    return -1; /* reject */
+    res = -1; /* reject */
+    goto cleanup;
   }
 
   /* All is well - write signature */
@@ -462,17 +431,20 @@ __contract__(
   MLD_CT_TESTING_DECLASSIFY(&z, sizeof(z));
   mld_pack_sig(sig, challenge_bytes, &z, &h, n);
 
+  res = 0; /* success */
+
+cleanup:
   /* FIPS 204. Section 3.6.3 Destruction of intermediate values. */
   mld_zeroize(challenge_bytes, MLDSA_CTILDEBYTES);
   mld_zeroize(&y, sizeof(y));
   mld_zeroize(&z, sizeof(z));
-  mld_zeroize(&w2, sizeof(w2));
+  mld_zeroize(&w, sizeof(w));
   mld_zeroize(&w1, sizeof(w1));
   mld_zeroize(&w0, sizeof(w0));
   mld_zeroize(&h, sizeof(h));
   mld_zeroize(&cp, sizeof(cp));
 
-  return 0; /* success */
+  return res;
 }
 MLD_MUST_CHECK_RETURN_VALUE
 int crypto_sign_signature_internal(uint8_t *sig, size_t *siglen,