Fixed sampler bug (update to new upstream Falcon code 2019-09-18).

[pornin]

As announced on the pqc-forum mailing-list yesterday, there's a nasty bug (really, two bugs) in the sampler implementation in Falcon, leading to seemingly valid but vulnerable signatures (i.e. the signatures leak information on the private key). This PR includes the necessary fixes. Test vectors have (by necessity) changed, I updated the hashes in the META.yml files.

For details on the bugs, see https://eprint.iacr.org/2019/893 (section 6).

[thomwiggers]

Thanks for the PR.

Ugh, clang-tidy can't make up it's mind on ppc, probably because it's a somewhat unstable version there (due to how the powerpc container is built from debian-ports).

As I don't really care much about that warning anyway, let's just disable it:

diff --git a/.clang-tidy b/.clang-tidy
index d141fd9..dafe2d1 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -1,5 +1,5 @@
----
-Checks:          '*,-llvm-header-guard,-hicpp-*,-readability-function-size,-google-readability-todo,-readability-magic-numbers,-cppcoreguidelines-avoid-magic-numbers,-readability-isolate-declaration'
+--
+Checks:          '*,-llvm-header-guard,-hicpp-*,-readability-function-size,-google-readability-todo,-readability-magic-numbers,-cppcoreguidelines-avoid-magic-numbers,-readability-isolate-declaration,-readability-uppercase-literal-suffix'
 WarningsAsErrors: '*'
 HeaderFilterRegex: '.*'
 AnalyzeTemporaryDtors: false

[thomwiggers]

Maybe also update the version number in the implementations: dicts.

[thomwiggers]

Because the clang-tidy thing also affected #234, I've now created a separate PR that disables that warning: #237.

[pornin]

Damn, it still fails. Apparently the fix on the 'u' / 'U' check has not come through yet...

... and it seems that that other fix has not been applied yet because of another "issue" (lack of an explicit cast from unsigned to int, required by clang-tidy on ppc only), which is fixed in this PR but was not in the other one. Or something like that.

[thomwiggers]

#235 didn't get merged because it failed the same bugprone-narrowing-conversion check – which does seem like it's worthwhile to keep around. I've pushed a patch to #235, hopefully that'll silence clang-tidy (which is probably running LLVM8 due to the debian unstable/experimental nature of the ppc container – Debian no longer officially support ppc). After it gets merged, this PR needs to be rebased.

Meanwhile I should maybe look into getting all test containers to run the same version of LLVM/Clang/GCC.

[thomwiggers]

Looks great, thanks.

I must say, I really appreciate all the docs in the code explaining what's going on. If only all the implementations were like this.