Skip to content

Verify size of mlen in ML-DSA external mu mode #2841

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Nov 25, 2025
Merged

Verify size of mlen in ML-DSA external mu mode #2841

Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
1a27be3
verify size of mlen in external mu mode
jakemas Nov 18, 2025
2185013
Cleanse intermediates when ending early
jakemas Nov 18, 2025
0d23bd5
CR fixes
jakemas Nov 19, 2025
5b1c5a5
Comment fixz
jakemas Nov 19, 2025
405486d
propigate return value
jakemas Nov 19, 2025
ff7fbb9
CR nits
jakemas Nov 20, 2025
f4128f8
Merge branch 'main' into mldsa-mu-length-check
jakemas Nov 20, 2025
eaa6bae
Merge branch 'main' into mldsa-mu-length-check
jakemas Nov 21, 2025
fccee3f
Merge branch 'main' into mldsa-mu-length-check
jakemas Nov 21, 2025
dbe6f09
Merge branch 'main' into mldsa-mu-length-check
jakemas Nov 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions crypto/fipsmodule/ml_dsa/ml_dsa_ref/sign.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,7 +161,7 @@ int ml_dsa_keypair(ml_dsa_params *params, uint8_t *pk, uint8_t *sk, uint8_t *see
* - uint8_t *sk: pointer to bit-packed secret key
* - int external_mu: indicates input message m is to be processed as mu
*
* Returns 0 (success) or -1 (context string too long)
* Returns 0 (success) or -1 (context string too long or incorrect mlen in external mu)
**************************************************/
int ml_dsa_sign_internal(ml_dsa_params *params,
uint8_t *sig,
Expand All @@ -184,6 +184,10 @@ int ml_dsa_sign_internal(ml_dsa_params *params,
ml_dsa_poly cp;
KECCAK1600_CTX state;
Copy link
Contributor

@github-actions github-actions bot Nov 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

warning: use of undeclared identifier 'KECCAK1600_CTX' [clang-diagnostic-error]

  KECCAK1600_CTX state;
  ^


if (external_mu && mlen != ML_DSA_CRHBYTES) {
return -1;
}

rho = seedbuf;
tr = rho + ML_DSA_SEEDBYTES;
key = tr + ML_DSA_TRBYTES;
Expand Down Expand Up @@ -346,12 +350,12 @@ int ml_dsa_sign(ml_dsa_params *params,
if (!RAND_bytes(rnd, ML_DSA_RNDBYTES)) {
return -1;
}
ml_dsa_sign_internal(params, sig, siglen, m, mlen, pre, 2 + ctxlen, rnd, sk, 0);
int ret = ml_dsa_sign_internal(params, sig, siglen, m, mlen, pre, 2 + ctxlen, rnd, sk, 0);

/* FIPS 204. Section 3.6.3 Destruction of intermediate values. */
OPENSSL_cleanse(pre, sizeof(pre));
OPENSSL_cleanse(rnd, sizeof(rnd));
return 0;
return ret;
}

/*************************************************
Expand Down Expand Up @@ -380,11 +384,11 @@ int ml_dsa_extmu_sign(ml_dsa_params *params,
if (!RAND_bytes(rnd, ML_DSA_RNDBYTES)) {
return -1;
}
ml_dsa_sign_internal(params, sig, siglen, mu, mulen, NULL, 0, rnd, sk, 1);
int ret = ml_dsa_sign_internal(params, sig, siglen, mu, mulen, NULL, 0, rnd, sk, 1);

/* FIPS 204. Section 3.6.3 Destruction of intermediate values. */
OPENSSL_cleanse(rnd, sizeof(rnd));
return 0;
return ret;
}

/*************************************************
Expand Down Expand Up @@ -469,6 +473,11 @@ int ml_dsa_verify_internal(ml_dsa_params *params,
if(siglen != params->bytes) {
Copy link
Contributor

@manastasova manastasova Nov 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we could add space here if <space> ( ....

Copy link
Collaborator Author

@jakemas jakemas Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is a mix of if's with and without -- for now I can live with this

return -1;
}

if (external_mu && mlen != ML_DSA_CRHBYTES) {
return -1;
}

/* FIPS 204: line 1 */
ml_dsa_unpack_pk(params, rho, &t1, pk);
/* FIPS 204: line 2 */
Expand Down
Loading