Skip to content

Commit cc2fdda

Browse files
douzzerdouzzer
authored
Merge pull request #9734 from SparkiDev/mlkem_mldsa_harden
ML-KEM/ML-DSA: harden against fault attacks
2 parents fc677d7 + 65a1a68 commit cc2fdda

4 files changed

Lines changed: 78 additions & 24 deletions

File tree

‎configure.ac‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2818,7 +2818,7 @@ AC_ARG_ENABLE([faultharden],
28182818

28192819
if test "$ENABLED_FAULTHARDEN" = "yes"
28202820
then
2821-
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CHECK_SIG_FAULTS -DWOLFSSL_CHECK_VER_FAULTS -DWC_SHA3_HARDEN"
2821+
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CHECK_SIG_FAULTS -DWOLFSSL_CHECK_VER_FAULTS -DWC_SHA3_FAULT_HARDEN -DWC_MLKEM_FAULT_HARDEN -DWC_MLDSA_FAULT_HARDEN"
28222822
fi
28232823

28242824
AC_ARG_ENABLE([compileharden],

‎wolfcrypt/src/dilithium.c‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8139,6 +8139,9 @@ static int dilithium_sign_with_seed_mu(dilithium_key* key,
81398139
sword32* ct0 = NULL;
81408140
byte priv_rand_seed[DILITHIUM_Y_SEED_SZ];
81418141
byte* h = sig + params->lambda / 4 + params->zEncSz;
8142+
#ifdef WC_MLDSA_FAULT_HARDEN
8143+
sword32* y_check;
8144+
#endif
81428145

81438146
/* Check the signature buffer isn't too small. */
81448147
if (*sigLen < params->sigSz) {
@@ -8203,6 +8206,9 @@ static int dilithium_sign_with_seed_mu(dilithium_key* key,
82038206
ret = MEMORY_E;
82048207
}
82058208
else {
8209+
#ifdef WC_MLDSA_FAULT_HARDEN
8210+
y_check = y;
8211+
#endif
82068212
w0 = y + params->s1Sz / sizeof(*y);
82078213
w1 = w0 + params->s2Sz / sizeof(*w0);
82088214
c = w1 + params->s2Sz / sizeof(*w1);
@@ -8271,6 +8277,14 @@ static int dilithium_sign_with_seed_mu(dilithium_key* key,
82718277
{
82728278
/* Step 13: NTT-1(A o NTT(y)) */
82738279
XMEMCPY(y_ntt, y, params->s1Sz);
8280+
#ifdef WC_MLDSA_FAULT_HARDEN
8281+
if (y_check != y) {
8282+
valid = 0;
8283+
ret = BAD_COND_E;
8284+
}
8285+
}
8286+
if (ret == 0) {
8287+
#endif
82748288
dilithium_vec_ntt_full(y_ntt, params->l);
82758289
dilithium_matrix_mul(w, a, y_ntt, params->k, params->l);
82768290
#ifdef WOLFSSL_DILITHIUM_SMALL
@@ -8415,6 +8429,9 @@ static int dilithium_sign_with_seed_mu(dilithium_key* key,
84158429
byte maxK = (byte)min(WOLFSSL_DILITHIUM_SIGN_SMALL_MEM_PRECALC_A,
84168430
params->k);
84178431
#endif
8432+
#ifdef WC_MLDSA_FAULT_HARDEN
8433+
sword32* y_check;
8434+
#endif
84188435

84198436
/* Check the signature buffer isn't too small. */
84208437
if ((ret == 0) && (*sigLen < params->sigSz)) {
@@ -8446,6 +8463,9 @@ static int dilithium_sign_with_seed_mu(dilithium_key* key,
84468463
ret = MEMORY_E;
84478464
}
84488465
else {
8466+
#ifdef WC_MLDSA_FAULT_HARDEN
8467+
y_check = y;
8468+
#endif
84498469
w0 = y + params->s1Sz / sizeof(*y_ntt);
84508470
w1 = w0 + params->s2Sz / sizeof(*w0);
84518471
blocks = (byte*)(w1 + params->s2Sz / sizeof(*w1));
@@ -8564,6 +8584,16 @@ static int dilithium_sign_with_seed_mu(dilithium_key* key,
85648584
#else
85658585
sword32* y_ntt_t = y_ntt;
85668586
#endif
8587+
#ifdef WC_MLDSA_FAULT_HARDEN
8588+
sword32* yt_check = yt;
8589+
#endif
8590+
#ifdef WC_MLDSA_FAULT_HARDEN
8591+
if (y_check != y) {
8592+
valid = 0;
8593+
ret = BAD_COND_E;
8594+
break;
8595+
}
8596+
#endif
85678597

85688598
/* Put r/i into buffer to be hashed. */
85698599
aseed[DILITHIUM_PUB_SEED_SZ + 1] = r;
@@ -8578,6 +8608,12 @@ static int dilithium_sign_with_seed_mu(dilithium_key* key,
85788608
break;
85798609
}
85808610
XMEMCPY(y_ntt_t, yt, DILITHIUM_POLY_SIZE);
8611+
#ifdef WC_MLDSA_FAULT_HARDEN
8612+
if (yt_check + s * DILITHIUM_N != yt) {
8613+
ret = BAD_COND_E;
8614+
break;
8615+
}
8616+
#endif
85818617
dilithium_ntt_full(y_ntt_t);
85828618
/* Matrix multiply. */
85838619
#ifndef WOLFSSL_DILITHIUM_SMALL_MEM_POLY64
@@ -8676,6 +8712,9 @@ static int dilithium_sign_with_seed_mu(dilithium_key* key,
86768712
/* Next polynomial. */
86778713
yt += DILITHIUM_N;
86788714
}
8715+
if (ret != 0) {
8716+
break;
8717+
}
86798718
#ifdef WOLFSSL_DILITHIUM_SMALL_MEM_POLY64
86808719
for (e = 0; e < DILITHIUM_N; e++) {
86818720
wt[e] = dilithium_mont_red(t64[e]);

‎wolfcrypt/src/sha3.c‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -595,18 +595,18 @@ static word64 Load64BitLittleEndian(const byte* a)
595595

596596
return n;
597597
}
598-
#elif defined(WC_SHA3_HARDEN)
598+
#elif defined(WC_SHA3_FAULT_HARDEN)
599599
static WC_INLINE word64 Load64Unaligned(const unsigned char *a)
600600
{
601601
#ifdef WC_64BIT_CPU
602602
return *(word64*)a;
603603
#elif defined(WC_32BIT_CPU)
604-
return (((word64)((word32*)a)[1]) << 32) ||
604+
return (((word64)((word32*)a)[1]) << 32) |
605605
((word32*)a)[0];
606606
#else
607-
return (((word64)((word16*)a)[3]) << 48) ||
608-
(((word64)((word16*)a)[2]) << 32) ||
609-
(((word64)((word16*)a)[1]) << 16) ||
607+
return (((word64)((word16*)a)[3]) << 48) |
608+
(((word64)((word16*)a)[2]) << 32) |
609+
(((word64)((word16*)a)[1]) << 16) |
610610
((word16*)a)[0];
611611
#endif
612612
}
@@ -712,9 +712,9 @@ static int Sha3Update(wc_Sha3* sha3, const byte* data, word32 len, byte p)
712712
{
713713
word32 i;
714714
word32 blocks;
715-
#ifdef WC_SHA3_HARDEN
716-
byte check = 0;
717-
byte total_check = 0;
715+
#ifdef WC_SHA3_FAULT_HARDEN
716+
word32 check = 0;
717+
word32 total_check = 0;
718718
#endif
719719

720720
#if defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && defined(USE_INTEL_SPEEDUP)
@@ -732,11 +732,11 @@ static int Sha3Update(wc_Sha3* sha3, const byte* data, word32 len, byte p)
732732
t = &sha3->t[sha3->i];
733733
for (i = 0; i < l; i++) {
734734
t[i] = data[i];
735-
#ifdef WC_SHA3_HARDEN
735+
#ifdef WC_SHA3_FAULT_HARDEN
736736
check++;
737737
#endif
738738
}
739-
#ifdef WC_SHA3_HARDEN
739+
#ifdef WC_SHA3_FAULT_HARDEN
740740
if (check != l) {
741741
return BAD_COND_E;
742742
}
@@ -747,16 +747,16 @@ static int Sha3Update(wc_Sha3* sha3, const byte* data, word32 len, byte p)
747747
sha3->i = (byte)(sha3->i + i);
748748

749749
if (sha3->i == p * 8) {
750-
#if !defined(BIG_ENDIAN_ORDER) && !defined(WC_SHA3_HARDEN)
750+
#if !defined(BIG_ENDIAN_ORDER) && !defined(WC_SHA3_FAULT_HARDEN)
751751
xorbuf(sha3->s, sha3->t, (word32)(p * 8));
752752
#else
753753
for (i = 0; i < p; i++) {
754754
sha3->s[i] ^= Load64BitLittleEndian(sha3->t + 8 * i);
755-
#ifdef WC_SHA3_HARDEN
755+
#ifdef WC_SHA3_FAULT_HARDEN
756756
check++;
757757
#endif
758758
}
759-
#ifdef WC_SHA3_HARDEN
759+
#ifdef WC_SHA3_FAULT_HARDEN
760760
if (check != p + l) {
761761
return BAD_COND_E;
762762
}
@@ -780,20 +780,20 @@ static int Sha3Update(wc_Sha3* sha3, const byte* data, word32 len, byte p)
780780
blocks = 0;
781781
}
782782
#endif
783-
#ifdef WC_SHA3_HARDEN
783+
#ifdef WC_SHA3_FAULT_HARDEN
784784
total_check += blocks * p;
785785
#endif
786786
for (; blocks > 0; blocks--) {
787-
#if !defined(BIG_ENDIAN_ORDER) && !defined(WC_SHA3_HARDEN)
787+
#if !defined(BIG_ENDIAN_ORDER) && !defined(WC_SHA3_FAULT_HARDEN)
788788
xorbuf(sha3->s, data, (word32)(p * 8));
789789
#else
790790
for (i = 0; i < p; i++) {
791791
sha3->s[i] ^= Load64Unaligned(data + 8 * i);
792-
#ifdef WC_SHA3_HARDEN
792+
#ifdef WC_SHA3_FAULT_HARDEN
793793
check++;
794794
#endif
795795
}
796-
#ifdef WC_SHA3_HARDEN
796+
#ifdef WC_SHA3_FAULT_HARDEN
797797
if (check != total_check - ((blocks - 1) * p)) {
798798
return BAD_COND_E;
799799
}
@@ -807,7 +807,7 @@ static int Sha3Update(wc_Sha3* sha3, const byte* data, word32 len, byte p)
807807
len -= p * 8U;
808808
data += p * 8U;
809809
}
810-
#ifdef WC_SHA3_HARDEN
810+
#ifdef WC_SHA3_FAULT_HARDEN
811811
if (check != total_check) {
812812
return BAD_COND_E;
813813
}
@@ -837,14 +837,14 @@ static int Sha3Final(wc_Sha3* sha3, byte padChar, byte* hash, byte p, word32 l)
837837
{
838838
word32 rate = p * 8U;
839839
word32 j;
840-
#if defined(BIG_ENDIAN_ORDER) || defined(WC_SHA3_HARDEN)
840+
#if defined(BIG_ENDIAN_ORDER) || defined(WC_SHA3_FAULT_HARDEN)
841841
word32 i;
842842
#endif
843-
#ifdef WC_SHA3_HARDEN
843+
#ifdef WC_SHA3_FAULT_HARDEN
844844
int check = 0;
845845
#endif
846846

847-
#if !defined(BIG_ENDIAN_ORDER) && !defined(WC_SHA3_HARDEN)
847+
#if !defined(BIG_ENDIAN_ORDER) && !defined(WC_SHA3_FAULT_HARDEN)
848848
xorbuf(sha3->s, sha3->t, sha3->i);
849849
#ifdef WOLFSSL_HASH_FLAGS
850850
if ((p == WC_SHA3_256_COUNT) && (sha3->flags & WC_HASH_SHA3_KECCAK256)) {
@@ -867,11 +867,11 @@ static int Sha3Final(wc_Sha3* sha3, byte padChar, byte* hash, byte p, word32 l)
867867
}
868868
for (i = 0; i < p; i++) {
869869
sha3->s[i] ^= Load64BitLittleEndian(sha3->t + 8 * i);
870-
#ifdef WC_SHA3_HARDEN
870+
#ifdef WC_SHA3_FAULT_HARDEN
871871
check++;
872872
#endif
873873
}
874-
#ifdef WC_SHA3_HARDEN
874+
#ifdef WC_SHA3_FAULT_HARDEN
875875
if (check != p) {
876876
return BAD_COND_E;
877877
}

‎wolfcrypt/src/wc_mlkem.c‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -434,7 +434,11 @@ int wc_MlKemKey_MakeKeyWithRandom(MlKemKey* key, const unsigned char* rand,
434434
{
435435
byte buf[2 * WC_ML_KEM_SYM_SZ + 1];
436436
byte* rho = buf;
437+
#ifndef WC_MLKEM_FAULT_HARDEN
437438
byte* sigma = buf + WC_ML_KEM_SYM_SZ;
439+
#else
440+
byte sigma[WC_ML_KEM_SYM_SZ + 1];
441+
#endif
438442
#ifndef WOLFSSL_NO_MALLOC
439443
sword16* e = NULL;
440444
#else
@@ -565,6 +569,17 @@ int wc_MlKemKey_MakeKeyWithRandom(MlKemKey* key, const unsigned char* rand,
565569
}
566570
#endif
567571
}
572+
#ifdef WC_MLKEM_FAULT_HARDEN
573+
if (ret == 0) {
574+
XMEMCPY(sigma, buf + WC_ML_KEM_SYM_SZ, WC_ML_KEM_SYM_SZ);
575+
if (XMEMCMP(sigma, rho, WC_ML_KEM_SYM_SZ) == 0) {
576+
ret = BAD_COND_E;
577+
}
578+
if (XMEMCMP(sigma, rho + WC_ML_KEM_SYM_SZ, WC_ML_KEM_SYM_SZ) != 0) {
579+
ret = BAD_COND_E;
580+
}
581+
}
582+
#endif
568583
if (ret == 0) {
569584
const byte* z = rand + WC_ML_KEM_SYM_SZ;
570585
s = key->priv;

0 commit comments

Comments
 (0)