FIPS: PCT enter error state upon 5 failures

Signed-off-by: Stephan Mueller <smueller@chronox.de>

Author: smuellerDD

curve25519/src/ed25519_pct.h

@@ -51,8 +51,8 @@ static inline int _lc_ed25519_pct_fips(const struct lc_ed25519_pk *pk,
 static inline int lc_ed25519_pct_fips(const struct lc_ed25519_pk *pk,
 				      const struct lc_ed25519_sk *sk)
 {
-	if (fips140_mode_enabled())
-		return _lc_ed25519_pct_fips(pk, sk);
+	FIPS140_PCT_LOOP(_lc_ed25519_pct_fips(pk, sk))
+
 	return 0;
 }
 

internal/api/fips_mode.h

@@ -31,6 +31,19 @@ extern "C" {
  */
 int fips140_mode_enabled(void);
 
+#define FIPS140_PCT_LOOP(func)                                                 \
+	if (fips140_mode_enabled()) {                                          \
+		unsigned int __i;                                              \
+		int __ret;                                                     \
+                                                                               \
+		for (__i = 0; __i < 5; __i++) {                                \
+			__ret = func;                                          \
+			if (!__ret)                                            \
+				return __ret;                                  \
+		}                                                              \
+		assert(0);                                                     \
+	}
+
 #ifdef __cplusplus
 }
 #endif

ml-dsa/src/dilithium_pct.h

@@ -51,8 +51,8 @@ static inline int _lc_dilithium_pct_fips(const struct lc_dilithium_pk *pk,
 static inline int lc_dilithium_pct_fips(const struct lc_dilithium_pk *pk,
 					const struct lc_dilithium_sk *sk)
 {
-	if (fips140_mode_enabled())
-		return _lc_dilithium_pct_fips(pk, sk);
+	FIPS140_PCT_LOOP(_lc_dilithium_pct_fips(pk, sk))
+
 	return 0;
 }
 

ml-kem/src/kyber_pct.h

@@ -72,8 +72,7 @@ static inline int _lc_kyber_pct_fips(const struct lc_kyber_pk *pk,
 static inline int lc_kyber_pct_fips(const struct lc_kyber_pk *pk,
 				    const struct lc_kyber_sk *sk)
 {
-	if (fips140_mode_enabled())
-		return _lc_kyber_pct_fips(pk, sk);
+	FIPS140_PCT_LOOP(_lc_kyber_pct_fips(pk, sk))
 	return 0;
 }
 

slh-dsa/src/sphincs_pct.h

@@ -51,8 +51,8 @@ static inline int _lc_sphincs_pct_fips(const struct lc_sphincs_pk *pk,
 static inline int lc_sphincs_pct_fips(const struct lc_sphincs_pk *pk,
 				      const struct lc_sphincs_sk *sk)
 {
-	if (fips140_mode_enabled())
-		return _lc_sphincs_pct_fips(pk, sk);
+	FIPS140_PCT_LOOP(_lc_sphincs_pct_fips(pk, sk))
+
 	return 0;
 }