Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Dilithium from crystals upstream #1894

Open
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

jakemas
Copy link
Contributor

@jakemas jakemas commented Oct 1, 2024

Issues:

Resolves #CryptoAlg-2722

Description of changes:

This PR updates the implementation of Dilithium (v3.1) with subsequent changes made in the official upstream repository (https://github.com/pq-crystals/dilithium).

As there are significant algorithmic changes between pre-FIPS 204 Dilithium (v3.1) and FIPS 204 IPD/Final we note that the integration of this code will cause Dilithium v3.1 signatures to fail. Consumers of AWS-LC were made aware of the unstable nature of the Dilithium implementation and API during the integration into the library (see https://github.com/aws/aws-lc/blob/8a1ee93969d8df64c4c51b2d6ddffb26a54adea9/crypto/dilithium/README.md).

As part of our due diligence we have verified that there are no existing deployments contingent on the stability of Dilithium. As such, we will continue to support the most up to date version of the algorithm from the authors upstream.

Call-outs:

Among the changes are modifications made per the FIPS 204 ML-DSA standard:

  • changes to signature and key sizes
  • addition of signing context "ctx" added to signature
  • removal of AES-based modes
  • new KATs

Testing:

As the signature size and private key size of ML-DSA has changed since v3.1, so too must the tests EVPExtraTest.d2i_PrivateKey for testing the parsing of ML-DSA private keys, as well as the certificates used for X509Test.TestDilithium3.

I have updated the private key kExampleDilithium3KeyDER and test certificate kDilithium3Cert to reflect changes to the signature/key lengths, but will need to manually reproduce test-case certificates kDilithium3CertNull, kDilithium3CertParam.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

@jakemas jakemas requested a review from a team as a code owner October 1, 2024 18:38
@codecov-commenter
Copy link

codecov-commenter commented Oct 1, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 78.46%. Comparing base (ad93747) to head (b3dd765).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1894   +/-   ##
=======================================
  Coverage   78.45%   78.46%           
=======================================
  Files         585      585           
  Lines       99516    99516           
  Branches    14244    14241    -3     
=======================================
+ Hits        78080    78087    +7     
+ Misses      20796    20795    -1     
+ Partials      640      634    -6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants