Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Kyber: fix kyber_from_msg() #7613

Merged
merged 1 commit into from
Jun 6, 2024
Merged

Kyber: fix kyber_from_msg() #7613

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions wolfcrypt/src/wc_kyber.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,11 @@

/******************************************************************************/

/* Declare variable to make compiler not optimize code in kyber_from_msg(). */
volatile sword16 kyber_opt_blocker = 0;

/******************************************************************************/

/**
* Initialize the Kyber key.
*
Expand Down
8 changes: 7 additions & 1 deletion wolfcrypt/src/wc_kyber_poly.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,9 @@

#ifdef WOLFSSL_WC_KYBER

/* Declared in wc_kyber.c to stop compiler optimizer from simplifying. */
extern volatile sword16 kyber_opt_blocker;

#ifdef USE_INTEL_SPEEDUP
static word32 cpuid_flags = 0;
#endif
Expand Down Expand Up @@ -2773,14 +2776,17 @@ void kyber_decompress_5(sword16* p, const unsigned char* b)
/* Convert bit from byte to 0 or (KYBER_Q + 1) / 2.
*
* Constant time implementation.
* XOR in kyber_opt_blocker to ensure optimizer doesn't know what will be ANDed
* with KYBER_Q_1_HALF and can't optimize to non-constant time code.
*
* @param [out] p Polynomial to hold converted value.
* @param [in] msg Message to get bit from byte from.
* @param [in] i Index of byte from message.
* @param [in] j Index of bit in byte.
*/
#define FROM_MSG_BIT(p, msg, i, j) \
p[8 * (i) + (j)] = ((sword16)0 - (sword16)(((msg)[i] >> (j)) & 1)) & KYBER_Q_1_HALF
(p)[8 * (i) + (j)] = (((sword16)0 - (sword16)(((msg)[i] >> (j)) & 1)) ^ \
kyber_opt_blocker) & KYBER_Q_1_HALF

/* Convert message to polynomial.
*
Expand Down