Skip to content

Commit b33fec8

Browse files
James-E-AJames-E-A
committed
Release 0.0.6.1
 * Include upstream security fix PQClean/PQClean#533 pq-crystals/kyber@dda29cc * Small tweaks to packaging metadata
2 parents fe1ffa2 + 98bbaba commit b33fec8

19 files changed

Lines changed: 120 additions & 39 deletions

File tree

‎MANIFEST.in‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,6 @@ recursive-exclude pqc *.py[cio]
55
recursive-exclude cffi_modules *.py[co]
66

77
# (Don't waste sdist space until the optimized variants are compiled)
8-
recursive-include Modules/PQClean/common/*/*/clean *
8+
recursive-include Modules/PQClean/common *
9+
recursive-include Modules/PQClean/crypto_kem/*/clean *
10+
recursive-include Modules/PQClean/crypto_sign/*/clean *

‎Modules/PQClean/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,7 @@ Regarding #2, adding the files to your project's build system, each implementati
174174
The following projects consume implementations from PQClean and provide their own wrappers around the implementations.
175175
Their integration strategies may serve as examples for your own projects.
176176
177+
- **[QuantCrypt](https://github.com/aabmets/quantcrypt)**: Cross-platform Python library for Post-Quantum Cryptography using precompiled PQClean binaries
177178
- **[pqcrypto crate](https://github.com/rustpq/pqcrypto)**: Rust integration that automatically generates wrappers from PQClean source code.
178179
- **[mupq](https://github.com/mupq/)**: Runs the implementations from PQClean as reference implementations to compare with microcontroller-optimized code.
179180
- **[Open Quantum Safe](https://github.com/open-quantum-safe/)**: The Open Quantum Safe project integrates implementations from PQClean into their [liboqs](https://github.com/open-quantum-safe/liboqs/) C library, which then exposes them via [C++](https://github.com/open-quantum-safe/liboqs-cpp), [C# / .NET](https://github.com/open-quantum-safe/liboqs-dotnet), and [Python](https://github.com/open-quantum-safe/liboqs-python) wrappers, as well as to forks of [OpenSSL](https://github.com/open-quantum-safe/openssl) and [OpenSSH](https://github.com/open-quantum-safe/openssh-portable).

‎Modules/PQClean/SECURITY.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,18 @@ Use at your own risk.
2020
### Historic issues
2121
* LEDAcryptKEM `leaktime` implementations are known to not be constant-time and expected to have timing side channel vulnerabilities.
2222
* LEDA support has since been dropped from PQClean as it got eliminated from the NIST PQC standardization project in round 3.
23-
* Rainbow level I has been shown to be insecure by Ward Beullens.
23+
* Rainbow level I has been shown to be insecure by Ward Beullens.
2424
* Rainbow was eliminated from the NIST PQC standardization project and removed from PQClean in round 4.
2525

2626
<!-- new date line
2727
### 2019-XX-XX
2828
-->
2929

30+
### 2024-01-25
31+
* Kyber used division operations that might leak side-channel information.
32+
[PR #534](https://github.com/PQClean/PQClean/pull/534) addressed this for the `clean` and `avx2` implementations.
33+
Note that the `aarch64` implementation is waiting for [PR#527](https://github.com/PQClean/PQClean/pull/527) to get fixed.
34+
3035
### 2020-12-11
3136
* The fix of the timing leak in the CCA transform of FrodoKEM in [PR #303](https://github.com/PQClean/PQClean/pull/303) was ineffective. The FrodoKEM team released another [fix](https://github.com/microsoft/PQCrypto-LWEKE/commit/669522db63850fa64d1a24a47e138e80a59349db) which was ported to PQClean in [PR #367](https://github.com/PQClean/PQClean/pull/367).
3237

‎Modules/PQClean/crypto_kem/kyber1024/META.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ auxiliary-submitters:
2222
- Jintai Ding
2323
implementations:
2424
- name: clean
25-
version: https://github.com/pq-crystals/kyber/commit/4ecce06d584a4e7cecc42f141aadae39b8431b06 via https://github.com/mkannwischer/package-pqclean/tree/146bcfac/kyber
25+
version: https://github.com/pq-crystals/kyber/commit/11d00ff1f20cfca1f72d819e5a45165c1e0a2816 via https://github.com/mkannwischer/package-pqclean/tree/0e93c032/kyber
2626
- name: avx2
27-
version: https://github.com/pq-crystals/kyber/commit/4ecce06d584a4e7cecc42f141aadae39b8431b06 via https://github.com/mkannwischer/package-pqclean/tree/146bcfac/kyber
27+
version: https://github.com/pq-crystals/kyber/commit/11d00ff1f20cfca1f72d819e5a45165c1e0a2816 via https://github.com/mkannwischer/package-pqclean/tree/0e93c032/kyber
2828
supported_platforms:
2929
- architecture: x86_64
3030
operating_systems:

‎Modules/PQClean/crypto_kem/kyber1024/clean/poly.c‎

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,22 @@
1616
* - const poly *a: pointer to input polynomial
1717
**************************************************/
1818
void PQCLEAN_KYBER1024_CLEAN_poly_compress(uint8_t r[KYBER_POLYCOMPRESSEDBYTES], const poly *a) {
19-
size_t i, j;
20-
int16_t u;
19+
unsigned int i, j;
20+
int32_t u;
21+
uint32_t d0;
2122
uint8_t t[8];
2223

2324
for (i = 0; i < KYBER_N / 8; i++) {
2425
for (j = 0; j < 8; j++) {
2526
// map to positive standard representatives
2627
u = a->coeffs[8 * i + j];
2728
u += (u >> 15) & KYBER_Q;
28-
t[j] = ((((uint32_t)u << 5) + KYBER_Q / 2) / KYBER_Q) & 31;
29+
/* t[j] = ((((uint32_t)u << 5) + KYBER_Q/2)/KYBER_Q) & 31; */
30+
d0 = u << 5;
31+
d0 += 1664;
32+
d0 *= 40318;
33+
d0 >>= 27;
34+
t[j] = d0 & 0x1f;
2935
}
3036

3137
r[0] = (t[0] >> 0) | (t[1] << 5);
@@ -141,15 +147,20 @@ void PQCLEAN_KYBER1024_CLEAN_poly_frommsg(poly *r, const uint8_t msg[KYBER_INDCP
141147
* - const poly *a: pointer to input polynomial
142148
**************************************************/
143149
void PQCLEAN_KYBER1024_CLEAN_poly_tomsg(uint8_t msg[KYBER_INDCPA_MSGBYTES], const poly *a) {
144-
size_t i, j;
145-
uint16_t t;
150+
unsigned int i, j;
151+
uint32_t t;
146152

147153
for (i = 0; i < KYBER_N / 8; i++) {
148154
msg[i] = 0;
149155
for (j = 0; j < 8; j++) {
150156
t = a->coeffs[8 * i + j];
151-
t += ((int16_t)t >> 15) & KYBER_Q;
152-
t = (((t << 1) + KYBER_Q / 2) / KYBER_Q) & 1;
157+
// t += ((int16_t)t >> 15) & KYBER_Q;
158+
// t = (((t << 1) + KYBER_Q/2)/KYBER_Q) & 1;
159+
t <<= 1;
160+
t += 1665;
161+
t *= 80635;
162+
t >>= 28;
163+
t &= 1;
153164
msg[i] |= t << j;
154165
}
155166
}

‎Modules/PQClean/crypto_kem/kyber1024/clean/polyvec.c‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,22 @@
1414
**************************************************/
1515
void PQCLEAN_KYBER1024_CLEAN_polyvec_compress(uint8_t r[KYBER_POLYVECCOMPRESSEDBYTES], const polyvec *a) {
1616
unsigned int i, j, k;
17+
uint64_t d0;
1718

1819
uint16_t t[8];
1920
for (i = 0; i < KYBER_K; i++) {
2021
for (j = 0; j < KYBER_N / 8; j++) {
2122
for (k = 0; k < 8; k++) {
2223
t[k] = a->vec[i].coeffs[8 * j + k];
2324
t[k] += ((int16_t)t[k] >> 15) & KYBER_Q;
24-
t[k] = ((((uint32_t)t[k] << 11) + KYBER_Q / 2) / KYBER_Q) & 0x7ff;
25+
/* t[k] = ((((uint32_t)t[k] << 11) + KYBER_Q/2)/KYBER_Q) & 0x7ff; */
26+
d0 = t[k];
27+
d0 <<= 11;
28+
d0 += 1664;
29+
d0 *= 645084;
30+
d0 >>= 31;
31+
t[k] = d0 & 0x7ff;
32+
2533
}
2634

2735
r[ 0] = (uint8_t)(t[0] >> 0);

‎Modules/PQClean/crypto_kem/kyber512/META.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ auxiliary-submitters:
2222
- Jintai Ding
2323
implementations:
2424
- name: clean
25-
version: https://github.com/pq-crystals/kyber/commit/4ecce06d584a4e7cecc42f141aadae39b8431b06 via https://github.com/mkannwischer/package-pqclean/tree/146bcfac/kyber
25+
version: https://github.com/pq-crystals/kyber/commit/11d00ff1f20cfca1f72d819e5a45165c1e0a2816 via https://github.com/mkannwischer/package-pqclean/tree/0e93c032/kyber
2626
- name: avx2
27-
version: https://github.com/pq-crystals/kyber/commit/4ecce06d584a4e7cecc42f141aadae39b8431b06 via https://github.com/mkannwischer/package-pqclean/tree/146bcfac/kyber
27+
version: https://github.com/pq-crystals/kyber/commit/11d00ff1f20cfca1f72d819e5a45165c1e0a2816 via https://github.com/mkannwischer/package-pqclean/tree/0e93c032/kyber
2828
supported_platforms:
2929
- architecture: x86_64
3030
operating_systems:

‎Modules/PQClean/crypto_kem/kyber512/clean/poly.c‎

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,22 @@
1616
* - const poly *a: pointer to input polynomial
1717
**************************************************/
1818
void PQCLEAN_KYBER512_CLEAN_poly_compress(uint8_t r[KYBER_POLYCOMPRESSEDBYTES], const poly *a) {
19-
size_t i, j;
20-
int16_t u;
19+
unsigned int i, j;
20+
int32_t u;
21+
uint32_t d0;
2122
uint8_t t[8];
2223

2324
for (i = 0; i < KYBER_N / 8; i++) {
2425
for (j = 0; j < 8; j++) {
2526
// map to positive standard representatives
2627
u = a->coeffs[8 * i + j];
2728
u += (u >> 15) & KYBER_Q;
28-
t[j] = ((((uint16_t)u << 4) + KYBER_Q / 2) / KYBER_Q) & 15;
29+
/* t[j] = ((((uint16_t)u << 4) + KYBER_Q/2)/KYBER_Q) & 15; */
30+
d0 = u << 4;
31+
d0 += 1665;
32+
d0 *= 80635;
33+
d0 >>= 28;
34+
t[j] = d0 & 0xf;
2935
}
3036

3137
r[0] = t[0] | (t[1] << 4);
@@ -128,15 +134,20 @@ void PQCLEAN_KYBER512_CLEAN_poly_frommsg(poly *r, const uint8_t msg[KYBER_INDCPA
128134
* - const poly *a: pointer to input polynomial
129135
**************************************************/
130136
void PQCLEAN_KYBER512_CLEAN_poly_tomsg(uint8_t msg[KYBER_INDCPA_MSGBYTES], const poly *a) {
131-
size_t i, j;
132-
uint16_t t;
137+
unsigned int i, j;
138+
uint32_t t;
133139

134140
for (i = 0; i < KYBER_N / 8; i++) {
135141
msg[i] = 0;
136142
for (j = 0; j < 8; j++) {
137143
t = a->coeffs[8 * i + j];
138-
t += ((int16_t)t >> 15) & KYBER_Q;
139-
t = (((t << 1) + KYBER_Q / 2) / KYBER_Q) & 1;
144+
// t += ((int16_t)t >> 15) & KYBER_Q;
145+
// t = (((t << 1) + KYBER_Q/2)/KYBER_Q) & 1;
146+
t <<= 1;
147+
t += 1665;
148+
t *= 80635;
149+
t >>= 28;
150+
t &= 1;
140151
msg[i] |= t << j;
141152
}
142153
}

‎Modules/PQClean/crypto_kem/kyber512/clean/polyvec.c‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,21 @@
1414
**************************************************/
1515
void PQCLEAN_KYBER512_CLEAN_polyvec_compress(uint8_t r[KYBER_POLYVECCOMPRESSEDBYTES], const polyvec *a) {
1616
unsigned int i, j, k;
17+
uint64_t d0;
1718

1819
uint16_t t[4];
1920
for (i = 0; i < KYBER_K; i++) {
2021
for (j = 0; j < KYBER_N / 4; j++) {
2122
for (k = 0; k < 4; k++) {
2223
t[k] = a->vec[i].coeffs[4 * j + k];
2324
t[k] += ((int16_t)t[k] >> 15) & KYBER_Q;
24-
t[k] = ((((uint32_t)t[k] << 10) + KYBER_Q / 2) / KYBER_Q) & 0x3ff;
25+
/* t[k] = ((((uint32_t)t[k] << 10) + KYBER_Q/2)/ KYBER_Q) & 0x3ff; */
26+
d0 = t[k];
27+
d0 <<= 10;
28+
d0 += 1665;
29+
d0 *= 1290167;
30+
d0 >>= 32;
31+
t[k] = d0 & 0x3ff;
2532
}
2633

2734
r[0] = (uint8_t)(t[0] >> 0);

‎Modules/PQClean/crypto_kem/kyber768/META.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ auxiliary-submitters:
2222
- Jintai Ding
2323
implementations:
2424
- name: clean
25-
version: https://github.com/pq-crystals/kyber/commit/4ecce06d584a4e7cecc42f141aadae39b8431b06 via https://github.com/mkannwischer/package-pqclean/tree/146bcfac/kyber
25+
version: https://github.com/pq-crystals/kyber/commit/11d00ff1f20cfca1f72d819e5a45165c1e0a2816 via https://github.com/mkannwischer/package-pqclean/tree/0e93c032/kyber
2626
- name: avx2
27-
version: https://github.com/pq-crystals/kyber/commit/4ecce06d584a4e7cecc42f141aadae39b8431b06 via https://github.com/mkannwischer/package-pqclean/tree/146bcfac/kyber
27+
version: https://github.com/pq-crystals/kyber/commit/11d00ff1f20cfca1f72d819e5a45165c1e0a2816 via https://github.com/mkannwischer/package-pqclean/tree/0e93c032/kyber
2828
supported_platforms:
2929
- architecture: x86_64
3030
operating_systems:

0 commit comments

Comments
 (0)