tree f383ebf6600f57d60ed85518de2b827794968e74
parent 1ec7a4ed6926f0f779553630ed7a78917e6f86b6
author David Benjamin <davidben@google.com> 1734369757 -0500
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1734379886 -0800

Run ML-KEM and ML-DSA through constant-time validation

We did this for Dilithium, but the tests themselves got lost for ML-DSA.
This is just a matter of adding some declassifies so that the tests can
survive running through with secret data marked secret.

As for what to mark secret, I opted to mark:

- Any internal secret output from the PRNG since that aligns better with
  crbug.com/42290551. Though it probably introduces a bunch of false
  positives on the TLS side because we haven't actually run all that
  through this yet.

- Any *uniformly* secret inputs in test vectors. That is, seeds, but
  *not* the serialized long-form private keys (which ought to become
  seeds anyway). This is because a portion of those serializations
  include public keys and it's tricky to declassify that before the
  public key parser gets confused.

To simplify comparisons, I added a Declassified() helper in test_util.h.
I considered just making == on Bytes automatically declassify, but then
we won't notice when we forget to, e.g. declassify ciphertext, so making
the test do it explicitly seemed worthwhile?

Change-Id: I2c53e25ca843ef876f2a89c15131a5b2b425603f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/74387
Reviewed-by: Adam Langley <agl@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>