[ML-DSA] Add pre-hashed API & domain separation #608
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
There are no Wycheproof vectors for the pre-hashed variant, but I've modified the spec-like python version we use to generate our own KATs so we can generate KATs for the pre-hashed version as well. |
franziskuskiefer
requested changes
Oct 1, 2024
franziskuskiefer
approved these changes
Oct 1, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR introduces a new pre-hashed API for ML-DSA and the additional domain separation via the
ctxparameter in signing and verification.The standard says that any NIST-approved hash function or XOF can be used to perform the pre-hashing in the HashML-DSA variant and explicitly lists cases for SHA-256, SHA-512, and SHAKE-128 in Algorithms 4 and 5. From this it wasn't clear to me if these three are mandatory for implementing the standard or if e.g. one of them is sufficient. For the sake of keeping things simple and additional dependencies in the crate minimal I've chosen to implement HashML-DSA just for SHAKE-128 pre-hashing, but we should be able to extend it to other NIST-approved hash functions or XOFs if desired, hopefully without much effort.
With these changes, we test successfully against the Wycheproof vectors for the final standard version, giving some confidence that we've implemented all changes which affect signing and verification. I've thus re-enabled these tests and extended them somewhat such that we test all variants (excluding pre-hashed) in all optimizations.
Fixes #500
Fixes #501
Fixes #607