Skip to content

Commit dd8d2a2

Browse files
dgarskedgarske
authored
Merge pull request #9575 from SparkiDev/dilithium_16_bit_fixes
MLDSA/Dilithium: fix 16-bit int issues
2 parents b5d3c87 + 21c8668 commit dd8d2a2

File tree

2 files changed

+85
-70
lines changed

2 files changed

+85
-70
lines changed

‎wolfcrypt/src/dilithium.c‎

Lines changed: 73 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1884,17 +1884,17 @@ static void dilithium_decode_gamma1_c(const byte* s, int bits, sword32* z)
18841884
#endif
18851885
#else
18861886
z[i+0] = DILITHIUM_GAMMA1_17 -
1887-
( s[ 0] | ((sword32)(s[ 1] << 8) |
1887+
( (sword32)s[ 0] | (((sword32)s[ 1] << 8) |
18881888
(sword32)(s[ 2] & 0x03) << 16));
18891889
z[i+1] = DILITHIUM_GAMMA1_17 -
1890-
((s[ 2] >> 2) | ((sword32)(s[ 3] << 6) |
1890+
(((sword32)s[ 2] >> 2) | (((sword32)s[ 3] << 6) |
18911891
(sword32)(s[ 4] & 0x0f) << 14));
18921892
z[i+2] = DILITHIUM_GAMMA1_17 -
1893-
((s[ 4] >> 4) | ((sword32)(s[ 5] << 4) |
1893+
(((sword32)s[ 4] >> 4) | (((sword32)s[ 5] << 4) |
18941894
(sword32)(s[ 6] & 0x3f) << 12));
18951895
z[i+3] = DILITHIUM_GAMMA1_17 -
1896-
((s[ 6] >> 6) | ((sword32)(s[ 7] << 2) |
1897-
(sword32)(s[ 8] ) << 10));
1896+
(((sword32)s[ 6] >> 6) | (((sword32)s[ 7] << 2) |
1897+
((sword32)s[ 8] ) << 10));
18981898
#endif
18991899
/* Move to next place to decode from. */
19001900
s += DILITHIUM_GAMMA1_17_ENC_BITS / 2;
@@ -1948,29 +1948,29 @@ static void dilithium_decode_gamma1_c(const byte* s, int bits, sword32* z)
19481948
#endif
19491949
#else
19501950
z[i+0] = (sword32)((word32)DILITHIUM_GAMMA1_17 -
1951-
( s[ 0] | ((sword32)(s[ 1] << 8) |
1952-
(sword32)(s[ 2] & 0x03) << 16)));
1951+
( (sword32)s[ 0] | (((sword32)s[ 1] << 8) |
1952+
((sword32)s[ 2] & 0x03) << 16)));
19531953
z[i+1] = (sword32)((word32)DILITHIUM_GAMMA1_17 -
1954-
((s[ 2] >> 2) | ((sword32)(s[ 3] << 6) |
1955-
(sword32)(s[ 4] & 0x0f) << 14)));
1954+
(((sword32)s[ 2] >> 2) | (((sword32)s[ 3] << 6) |
1955+
((sword32)s[ 4] & 0x0f) << 14)));
19561956
z[i+2] = (sword32)((word32)DILITHIUM_GAMMA1_17 -
1957-
((s[ 4] >> 4) | ((sword32)(s[ 5] << 4) |
1958-
(sword32)(s[ 6] & 0x3f) << 12)));
1957+
(((sword32)s[ 4] >> 4) | (((sword32)s[ 5] << 4) |
1958+
((sword32)s[ 6] & 0x3f) << 12)));
19591959
z[i+3] = (sword32)((word32)DILITHIUM_GAMMA1_17 -
1960-
((s[ 6] >> 6) | ((sword32)(s[ 7] << 2) |
1961-
(sword32)(s[ 8] ) << 10)));
1960+
(((sword32)s[ 6] >> 6) | (((sword32)s[ 7] << 2) |
1961+
((sword32)s[ 8] ) << 10)));
19621962
z[i+4] = (sword32)((word32)DILITHIUM_GAMMA1_17 -
1963-
( s[ 9] | ((sword32)(s[10] << 8) |
1964-
(sword32)(s[11] & 0x03) << 16)));
1963+
( (sword32)s[ 9] | (((sword32)s[10] << 8) |
1964+
((sword32)s[11] & 0x03) << 16)));
19651965
z[i+5] = (sword32)((word32)DILITHIUM_GAMMA1_17 -
1966-
((s[11] >> 2) | ((sword32)(s[12] << 6) |
1967-
(sword32)(s[13] & 0x0f) << 14)));
1966+
(((sword32)s[11] >> 2) | (((sword32)s[12] << 6) |
1967+
((sword32)s[13] & 0x0f) << 14)));
19681968
z[i+6] = (sword32)((word32)DILITHIUM_GAMMA1_17 -
1969-
((s[13] >> 4) | ((sword32)(s[14] << 4) |
1970-
(sword32)(s[15] & 0x3f) << 12)));
1969+
(((sword32)s[13] >> 4) | (((sword32)s[14] << 4) |
1970+
((sword32)s[15] & 0x3f) << 12)));
19711971
z[i+7] = (sword32)((word32)DILITHIUM_GAMMA1_17 -
1972-
((s[15] >> 6) | ((sword32)(s[16] << 2) |
1973-
(sword32)(s[17] ) << 10)));
1972+
(((sword32)s[15] >> 6) | (((sword32)s[16] << 2) |
1973+
((sword32)s[17] ) << 10)));
19741974
#endif
19751975
/* Move to next place to decode from. */
19761976
s += DILITHIUM_GAMMA1_17_ENC_BITS;
@@ -2005,14 +2005,18 @@ static void dilithium_decode_gamma1_c(const byte* s, int bits, sword32* z)
20052005
((sword32)s16_0 << 4));
20062006
#endif
20072007
#else
2008-
z[i+0] = DILITHIUM_GAMMA1_19 - ( s[0] | ((sword32)s[1] << 8) |
2009-
((sword32)(s[2] & 0x0f) << 16));
2010-
z[i+1] = DILITHIUM_GAMMA1_19 - ((s[2] >> 4) | ((sword32)s[3] << 4) |
2011-
((sword32)(s[4] ) << 12));
2012-
z[i+2] = DILITHIUM_GAMMA1_19 - ( s[5] | ((sword32)s[6] << 8) |
2013-
((sword32)(s[7] & 0x0f) << 16));
2014-
z[i+3] = DILITHIUM_GAMMA1_19 - ((s[7] >> 4) | ((sword32)s[8] << 4) |
2015-
((sword32)(s[9] ) << 12));
2008+
z[i+0] = DILITHIUM_GAMMA1_19 -
2009+
( (sword32)s[0] | ((sword32)s[1] << 8) |
2010+
(((sword32)s[2] & 0x0f) << 16));
2011+
z[i+1] = DILITHIUM_GAMMA1_19 -
2012+
(((sword32)s[2] >> 4) | ((sword32)s[3] << 4) |
2013+
(((sword32)s[4] ) << 12));
2014+
z[i+2] = DILITHIUM_GAMMA1_19 -
2015+
( (sword32)s[5] | ((sword32)s[6] << 8) |
2016+
(((sword32)s[7] & 0x0f) << 16));
2017+
z[i+3] = DILITHIUM_GAMMA1_19 -
2018+
(((sword32)s[7] >> 4) | ((sword32)s[8] << 4) |
2019+
(((sword32)s[9] ) << 12));
20162020
#endif
20172021
/* Move to next place to decode from. */
20182022
s += DILITHIUM_GAMMA1_19_ENC_BITS / 2;
@@ -2065,30 +2069,38 @@ static void dilithium_decode_gamma1_c(const byte* s, int bits, sword32* z)
20652069
((sword32)s16_1 << 4));
20662070
#endif
20672071
#else
2068-
z[i+0] = DILITHIUM_GAMMA1_19 - ( s[ 0] |
2069-
((sword32)s[ 1] << 8) |
2070-
((sword32)(s[ 2] & 0x0f) << 16));
2071-
z[i+1] = DILITHIUM_GAMMA1_19 - ((s[ 2] >> 4) |
2072-
((sword32) s[ 3] << 4) |
2073-
((sword32)(s[ 4] ) << 12));
2074-
z[i+2] = DILITHIUM_GAMMA1_19 - ( s[ 5] |
2075-
((sword32) s[ 6] << 8) |
2076-
((sword32)(s[ 7] & 0x0f) << 16));
2077-
z[i+3] = DILITHIUM_GAMMA1_19 - ((s[ 7] >> 4) |
2078-
((sword32) s[ 8] << 4) |
2079-
((sword32)(s[ 9] ) << 12));
2080-
z[i+4] = DILITHIUM_GAMMA1_19 - ( s[10] |
2081-
((sword32) s[11] << 8) |
2082-
((sword32)(s[12] & 0x0f) << 16));
2083-
z[i+5] = DILITHIUM_GAMMA1_19 - ((s[12] >> 4) |
2084-
((sword32) s[13] << 4) |
2085-
((sword32)(s[14] ) << 12));
2086-
z[i+6] = DILITHIUM_GAMMA1_19 - ( s[15] |
2087-
((sword32) s[16] << 8) |
2088-
((sword32)(s[17] & 0x0f) << 16));
2089-
z[i+7] = DILITHIUM_GAMMA1_19 - ((s[17] >> 4) |
2090-
((sword32) s[18] << 4) |
2091-
((sword32)(s[19] ) << 12));
2072+
z[i+0] = DILITHIUM_GAMMA1_19 -
2073+
( (sword32)s[ 0] |
2074+
( (sword32)s[ 1] << 8) |
2075+
(((sword32)s[ 2] & 0x0f) << 16));
2076+
z[i+1] = DILITHIUM_GAMMA1_19 -
2077+
(((sword32)s[ 2] >> 4) |
2078+
( (sword32)s[ 3] << 4) |
2079+
(((sword32)s[ 4] ) << 12));
2080+
z[i+2] = DILITHIUM_GAMMA1_19 -
2081+
( (sword32)s[ 5] |
2082+
( (sword32)s[ 6] << 8) |
2083+
(((sword32)s[ 7] & 0x0f) << 16));
2084+
z[i+3] = DILITHIUM_GAMMA1_19 -
2085+
( ((sword32)s[ 7] >> 4) |
2086+
( (sword32)s[ 8] << 4) |
2087+
(((sword32)s[ 9] ) << 12));
2088+
z[i+4] = DILITHIUM_GAMMA1_19 -
2089+
( (sword32)s[10] |
2090+
( (sword32)s[11] << 8) |
2091+
(((sword32)s[12] & 0x0f) << 16));
2092+
z[i+5] = DILITHIUM_GAMMA1_19 -
2093+
( ((sword32)s[12] >> 4) |
2094+
( (sword32)s[13] << 4) |
2095+
(((sword32)s[14] ) << 12));
2096+
z[i+6] = DILITHIUM_GAMMA1_19 -
2097+
( (sword32)s[15] |
2098+
( (sword32)s[16] << 8) |
2099+
(((sword32)s[17] & 0x0f) << 16));
2100+
z[i+7] = DILITHIUM_GAMMA1_19 -
2101+
( ((sword32)s[17] >> 4) |
2102+
( (sword32)s[18] << 4) |
2103+
(((sword32)s[19] ) << 12));
20922104
#endif
20932105
/* Move to next place to decode from. */
20942106
s += DILITHIUM_GAMMA1_19_ENC_BITS;
@@ -2868,7 +2880,7 @@ static int wc_mldsa_gen_matrix_6x5_avx2(sword32* a, byte* seed)
28682880
}
28692881

28702882
for (l = 0; l < 2; l++) {
2871-
state[4*4 + l] = 0x1f0000 + (5 << 8) + (l + 3);
2883+
state[4*4 + l] = 0x1f0000 + ((word32)5 << 8) + (l + 3);
28722884
}
28732885

28742886
sha3_128_blocksx4_seed_avx2(state, seed);
@@ -5451,7 +5463,7 @@ static sword32 dilithium_mont_red(sword64 a)
54515463
*/
54525464
static sword32 dilithium_red(sword32 a)
54535465
{
5454-
sword32 t = (sword32)((a + (1 << 22)) >> 23);
5466+
sword32 t = (sword32)((a + ((sword32)1 << 22)) >> 23);
54555467
#ifndef DILITHIUM_MUL_Q_SLOW
54565468
return (sword32)(a - (t * DILITHIUM_Q));
54575469
#else
@@ -8252,7 +8264,7 @@ static int dilithium_sign_with_seed_mu(dilithium_key* key,
82528264
params->gamma1_bits, y, params->l);
82538265
#ifdef WOLFSSL_DILITHIUM_SIGN_CHECK_Y
82548266
valid = dilithium_vec_check_low(y, params->l,
8255-
(1 << params->gamma1_bits) - params->beta);
8267+
((sword32)1 << params->gamma1_bits) - params->beta);
82568268
if (valid)
82578269
#endif
82588270
{
@@ -8306,7 +8318,7 @@ static int dilithium_sign_with_seed_mu(dilithium_key* key,
83068318
valid = dilithium_vec_check_low(w0 + i * DILITHIUM_N, 1,
83078319
hi);
83088320
}
8309-
hi = (1 << params->gamma1_bits) - params->beta;
8321+
hi = ((sword32)1 << params->gamma1_bits) - params->beta;
83108322
for (i = 0; valid && i < params->l; i++) {
83118323
/* Step 19: cs1 = NTT-1(c o s1) */
83128324
dilithium_mul(z + i * DILITHIUM_N, c,
@@ -8515,7 +8527,7 @@ static int dilithium_sign_with_seed_mu(dilithium_key* key,
85158527
params->gamma1_bits, y, params->l);
85168528
#ifdef WOLFSSL_DILITHIUM_SIGN_CHECK_Y
85178529
valid = dilithium_vec_check_low(y, params->l,
8518-
(1 << params->gamma1_bits) - params->beta);
8530+
((sword32)1 << params->gamma1_bits) - params->beta);
85198531
#endif
85208532

85218533
#ifdef WOLFSSL_DILITHIUM_SIGN_SMALL_MEM_PRECALC_A
@@ -8743,7 +8755,7 @@ static int dilithium_sign_with_seed_mu(dilithium_key* key,
87438755
dilithium_add(z, yt);
87448756
dilithium_poly_red(z);
87458757
/* Step 23: Check z has low enough values. */
8746-
hi = (1 << params->gamma1_bits) - params->beta;
8758+
hi = ((sword32)1 << params->gamma1_bits) - params->beta;
87478759
valid = dilithium_check_low(z, hi);
87488760
if (valid) {
87498761
/* Step 32: Encode z into signature.
@@ -9385,7 +9397,7 @@ static int dilithium_verify_mu(dilithium_key* key, const byte* mu,
93859397
/* Step 2: Decode z from signature. */
93869398
dilithium_vec_decode_gamma1(ze, params->l, params->gamma1_bits, z);
93879399
/* Step 13: Check z is valid - values are low enough. */
9388-
hi = (1 << params->gamma1_bits) - params->beta;
9400+
hi = ((sword32)1 << params->gamma1_bits) - params->beta;
93899401
valid = dilithium_vec_check_low(z, params->l, hi);
93909402
}
93919403
if ((ret == 0) && valid) {
@@ -9524,7 +9536,7 @@ static int dilithium_verify_mu(dilithium_key* key, const byte* mu,
95249536
/* Step 2: Decode z from signature. */
95259537
dilithium_vec_decode_gamma1(ze, params->l, params->gamma1_bits, z);
95269538
/* Step 13: Check z is valid - values are low enough. */
9527-
hi = (1 << params->gamma1_bits) - params->beta;
9539+
hi = ((sword32)1 << params->gamma1_bits) - params->beta;
95289540
valid = dilithium_vec_check_low(z, params->l, hi);
95299541
}
95309542
if ((ret == 0) && valid) {

‎wolfssl/wolfcrypt/dilithium.h‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -200,23 +200,23 @@
200200
/* Number of dropped bits. */
201201
#define DILITHIUM_D 13
202202
/* Maximum value of dropped bits. */
203-
#define DILITHIUM_D_MAX (1 << DILITHIUM_D)
203+
#define DILITHIUM_D_MAX ((sword32)1 << DILITHIUM_D)
204204
/* Half maximum value. */
205-
#define DILITHIUM_D_MAX_HALF (1 << (DILITHIUM_D - 1))
205+
#define DILITHIUM_D_MAX_HALF ((sword32)1 << (DILITHIUM_D - 1))
206206
/* Number of undropped bits. */
207207
#define DILITHIUM_U (DILITHIUM_Q_BITS - DILITHIUM_D)
208208

209209
/* Bits in coefficient range of y, GAMMA1, of 2^17 is 17. */
210210
#define DILITHIUM_GAMMA1_BITS_17 17
211211
/* Coefficient range of y, GAMMA1, of 2^17. */
212-
#define DILITHIUM_GAMMA1_17 (1 << 17)
212+
#define DILITHIUM_GAMMA1_17 ((sword32)1 << 17)
213213
/* # encoding bits of y is GAMMA1 + 1. */
214214
#define DILITHIUM_GAMMA1_17_ENC_BITS 18
215215
/* Coefficient range of y, GAMMA1, of 2^17. */
216216
/* Bits in coefficient range of y, GAMMA1, of 2^19 is 19. */
217217
#define DILITHIUM_GAMMA1_BITS_19 19
218218
/* Coefficient range of y, GAMMA1, of 2^19. */
219-
#define DILITHIUM_GAMMA1_19 (1 << 19)
219+
#define DILITHIUM_GAMMA1_19 ((sword32)1 << 19)
220220
/* # encoding bits of y is GAMMA1 + 1. */
221221
#define DILITHIUM_GAMMA1_19_ENC_BITS 20
222222

@@ -265,13 +265,14 @@
265265
#define PARAMS_ML_DSA_44_TAU 39
266266
/* BETA = TAU * ETA for ML-DSA-44. */
267267
#define PARAMS_ML_DSA_44_BETA \
268-
(PARAMS_ML_DSA_44_TAU * PARAMS_ML_DSA_44_ETA)
268+
(PARAMS_ML_DSA_44_TAU * PARAMS_ML_DSA_44_ETA)
269269
/* Max # 1's in the hint h, OMEGA, for ML-DSA-44. */
270270
#define PARAMS_ML_DSA_44_OMEGA 80
271271
/* Bits in coefficient range of y, GAMMA1, for ML-DSA-44. */
272272
#define PARAMS_ML_DSA_44_GAMMA1_BITS DILITHIUM_GAMMA1_BITS_17
273273
/* Ccoefficient range of y, GAMMA1, for ML-DSA-44. */
274-
#define PARAMS_ML_DSA_44_GAMMA1 (1 << PARAMS_ML_DSA_44_GAMMA1_BITS)
274+
#define PARAMS_ML_DSA_44_GAMMA1 \
275+
((sword32)1 << PARAMS_ML_DSA_44_GAMMA1_BITS)
275276
/* Low-order rounding range, GAMMA2, for ML-DSA-44. */
276277
#define PARAMS_ML_DSA_44_GAMMA2 DILITHIUM_Q_LOW_88
277278
/* Bits in high-order rounding range, GAMMA2, for ML-DSA-44. */
@@ -331,8 +332,9 @@
331332
#define PARAMS_ML_DSA_65_OMEGA 55
332333
/* Bits in coefficient range of y, GAMMA1, for ML-DSA-65. */
333334
#define PARAMS_ML_DSA_65_GAMMA1_BITS DILITHIUM_GAMMA1_BITS_19
334-
/* Ccoefficient range of y, GAMMA1, for ML-DSA-65. */
335-
#define PARAMS_ML_DSA_65_GAMMA1 (1 << PARAMS_ML_DSA_65_GAMMA1_BITS)
335+
/* Coefficient range of y, GAMMA1, for ML-DSA-65. */
336+
#define PARAMS_ML_DSA_65_GAMMA1 \
337+
((sword32)1 << PARAMS_ML_DSA_65_GAMMA1_BITS)
336338
/* Low-order rounding range, GAMMA2, for ML-DSA-65. */
337339
#define PARAMS_ML_DSA_65_GAMMA2 DILITHIUM_Q_LOW_32
338340
/* Bits in high-order rounding range, GAMMA2, for ML-DSA-65. */
@@ -393,7 +395,8 @@
393395
/* Bits in coefficient range of y, GAMMA1, for ML-DSA-87. */
394396
#define PARAMS_ML_DSA_87_GAMMA1_BITS DILITHIUM_GAMMA1_BITS_19
395397
/* Ccoefficient range of y, GAMMA1, for ML-DSA-87. */
396-
#define PARAMS_ML_DSA_87_GAMMA1 (1 << PARAMS_ML_DSA_87_GAMMA1_BITS)
398+
#define PARAMS_ML_DSA_87_GAMMA1 \
399+
((sword32)1 << PARAMS_ML_DSA_87_GAMMA1_BITS)
397400
/* Low-order rounding range, GAMMA2, for ML-DSA-87. */
398401
#define PARAMS_ML_DSA_87_GAMMA2 DILITHIUM_Q_LOW_32
399402
/* Bits in high-order rounding range, GAMMA2, for ML-DSA-87. */

0 commit comments

Comments
 (0)