tree 390c01feb9ad756346033e263e29878a29ac5135
parent 3efe2eb9e3dfb49cb110c53e3430caeae4599f52
author David Benjamin <davidben@google.com> 1712782323 -0400
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1715272111 +0000

Make Dilithium pass constant-time validation

Tested with GCC[0] and Clang[1] on x86_64 in release builds:

- Declassify the signature before outputting it

- Declassify the public key before outputting it

- Some asserts need to be declassify_assert because they act on secret
  data.

- Rejection sampling is not actually vartime (good because it's run with
  secret inputs + outputs), but does need declassifications.

- Rejecting the signature is an intentional declassification. But also
  compute all the intermediate values with constant time functions and a
  value barrier (hidden inside the declassify call) because the compiler
  will otherwise leak which arm of the || fired.

- SampleInBall is... unclear. Declassify it for now, because the
  algorithm is only viable if this is safe to leak, but leave a TODO
  because we will need to follow-up with the Dilithium authors.

[0] gcc (Debian 13.2.0-10) 13.2.0
[1] clang version 19.0.0git (https://chromium.googlesource.com/a/external/github.com/llvm/llvm-project 315c88c5fbdb2b27cebf23c87fb502f7a567d84b)

Change-Id: I362e69bd3d1ea59fb0dbf35574e654c371061af6
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/67747
Reviewed-by: Bob Beck <bbe@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Commit-Queue: Bob Beck <bbe@google.com>