From 15e6dad043d3c556e6152a576b7fe8f1caf1980b Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Thu, 15 Jan 2026 23:30:59 +0100 Subject: [PATCH] Just use sodium_memcmp --- .../mlkem768/ref/kem_mlkem768_ref.c | 41 +++---------------- 1 file changed, 5 insertions(+), 36 deletions(-) diff --git a/src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c b/src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c index 8deb8a9c..4c2c4e93 100644 --- a/src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c +++ b/src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c @@ -3,7 +3,6 @@ #include "crypto_hash_sha3.h" #include "crypto_kem_mlkem768.h" -#include "crypto_verify_32.h" #include "crypto_xof_shake128.h" #include "crypto_xof_shake256.h" #include "kem_mlkem768_ref.h" @@ -761,6 +760,7 @@ mlkem768_ref_dec(unsigned char *ss, const unsigned char *ct, const unsigned char const unsigned char *hpk = sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES; const unsigned char *z = sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES + 32; int fail; + unsigned int fail_mask; crypto_xof_shake256_state state; indcpa_dec(buf, ct, sk); @@ -771,47 +771,16 @@ mlkem768_ref_dec(unsigned char *ss, const unsigned char *ct, const unsigned char indcpa_enc(cmp, buf, pk, kr + 32); - fail = crypto_verify_32(ct, cmp); - fail |= crypto_verify_32(ct + 32, cmp + 32); - fail |= crypto_verify_32(ct + 64, cmp + 64); - fail |= crypto_verify_32(ct + 96, cmp + 96); - fail |= crypto_verify_32(ct + 128, cmp + 128); - fail |= crypto_verify_32(ct + 160, cmp + 160); - fail |= crypto_verify_32(ct + 192, cmp + 192); - fail |= crypto_verify_32(ct + 224, cmp + 224); - fail |= crypto_verify_32(ct + 256, cmp + 256); - fail |= crypto_verify_32(ct + 288, cmp + 288); - fail |= crypto_verify_32(ct + 320, cmp + 320); - fail |= crypto_verify_32(ct + 352, cmp + 352); - fail |= crypto_verify_32(ct + 384, cmp + 384); - fail |= crypto_verify_32(ct + 416, cmp + 416); - fail |= crypto_verify_32(ct + 448, cmp + 448); - fail |= crypto_verify_32(ct + 480, cmp + 480); - fail |= crypto_verify_32(ct + 512, cmp + 512); - fail |= crypto_verify_32(ct + 544, cmp + 544); - fail |= crypto_verify_32(ct + 576, cmp + 576); - fail |= crypto_verify_32(ct + 608, cmp + 608); - fail |= crypto_verify_32(ct + 640, cmp + 640); - fail |= crypto_verify_32(ct + 672, cmp + 672); - fail |= crypto_verify_32(ct + 704, cmp + 704); - fail |= crypto_verify_32(ct + 736, cmp + 736); - fail |= crypto_verify_32(ct + 768, cmp + 768); - fail |= crypto_verify_32(ct + 800, cmp + 800); - fail |= crypto_verify_32(ct + 832, cmp + 832); - fail |= crypto_verify_32(ct + 864, cmp + 864); - fail |= crypto_verify_32(ct + 896, cmp + 896); - fail |= crypto_verify_32(ct + 928, cmp + 928); - fail |= crypto_verify_32(ct + 960, cmp + 960); - fail |= crypto_verify_32(ct + 992, cmp + 992); - fail |= crypto_verify_32(ct + 1024, cmp + 1024); - fail |= crypto_verify_32(ct + 1056, cmp + 1056); + fail = sodium_memcmp(ct, cmp, crypto_kem_mlkem768_CIPHERTEXTBYTES); + fail_mask = (unsigned int) fail; + fail_mask >>= (sizeof(fail_mask) * 8U - 1U); crypto_xof_shake256_init(&state); crypto_xof_shake256_update(&state, z, 32); crypto_xof_shake256_update(&state, ct, crypto_kem_mlkem768_CIPHERTEXTBYTES); crypto_xof_shake256_squeeze(&state, k_bar, crypto_kem_mlkem768_SHAREDSECRETBYTES); - cmov(kr, k_bar, crypto_kem_mlkem768_SHAREDSECRETBYTES, (unsigned char) (fail != 0)); + cmov(kr, k_bar, crypto_kem_mlkem768_SHAREDSECRETBYTES, (unsigned char) fail_mask); memcpy(ss, kr, crypto_kem_mlkem768_SHAREDSECRETBYTES);