QPQ-AG/libsodium
12
0
Fork 0
mirror of https://github.com/jedisct1/libsodium.git synced 2026-08-25 08:37:13 +09:00
Code Issues Packages Projects Releases Wiki Activity

Just use sodium_memcmp

Browse Source
This commit is contained in:
Frank Denis
2026-01-15 23:30:59 +01:00
parent 557dc9e51d
commit 15e6dad043
1 changed files with 5 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c
+5 -36
View File
@@ -3,7 +3,6 @@
#include "crypto_hash_sha3.h"
#include "crypto_kem_mlkem768.h"
#include "crypto_verify_32.h"
#include "crypto_xof_shake128.h"
#include "crypto_xof_shake256.h"
#include "kem_mlkem768_ref.h"
@@ -761,6 +760,7 @@ mlkem768_ref_dec(unsigned char *ss, const unsigned char *ct, const unsigned char
const unsigned char *hpk = sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES;
const unsigned char *z = sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES + 32;
int fail;
unsigned int fail_mask;
crypto_xof_shake256_state state;
indcpa_dec(buf, ct, sk);
@@ -771,47 +771,16 @@ mlkem768_ref_dec(unsigned char *ss, const unsigned char *ct, const unsigned char
indcpa_enc(cmp, buf, pk, kr + 32);
fail = crypto_verify_32(ct, cmp);
fail |= crypto_verify_32(ct + 32, cmp + 32);
fail |= crypto_verify_32(ct + 64, cmp + 64);
fail |= crypto_verify_32(ct + 96, cmp + 96);
fail |= crypto_verify_32(ct + 128, cmp + 128);
fail |= crypto_verify_32(ct + 160, cmp + 160);
fail |= crypto_verify_32(ct + 192, cmp + 192);
fail |= crypto_verify_32(ct + 224, cmp + 224);
fail |= crypto_verify_32(ct + 256, cmp + 256);
fail |= crypto_verify_32(ct + 288, cmp + 288);
fail |= crypto_verify_32(ct + 320, cmp + 320);
fail |= crypto_verify_32(ct + 352, cmp + 352);
fail |= crypto_verify_32(ct + 384, cmp + 384);
fail |= crypto_verify_32(ct + 416, cmp + 416);
fail |= crypto_verify_32(ct + 448, cmp + 448);
fail |= crypto_verify_32(ct + 480, cmp + 480);
fail |= crypto_verify_32(ct + 512, cmp + 512);
fail |= crypto_verify_32(ct + 544, cmp + 544);
fail |= crypto_verify_32(ct + 576, cmp + 576);
fail |= crypto_verify_32(ct + 608, cmp + 608);
fail |= crypto_verify_32(ct + 640, cmp + 640);
fail |= crypto_verify_32(ct + 672, cmp + 672);
fail |= crypto_verify_32(ct + 704, cmp + 704);
fail |= crypto_verify_32(ct + 736, cmp + 736);
fail |= crypto_verify_32(ct + 768, cmp + 768);
fail |= crypto_verify_32(ct + 800, cmp + 800);
fail |= crypto_verify_32(ct + 832, cmp + 832);
fail |= crypto_verify_32(ct + 864, cmp + 864);
fail |= crypto_verify_32(ct + 896, cmp + 896);
fail |= crypto_verify_32(ct + 928, cmp + 928);
fail |= crypto_verify_32(ct + 960, cmp + 960);
fail |= crypto_verify_32(ct + 992, cmp + 992);
fail |= crypto_verify_32(ct + 1024, cmp + 1024);
fail |= crypto_verify_32(ct + 1056, cmp + 1056);
fail = sodium_memcmp(ct, cmp, crypto_kem_mlkem768_CIPHERTEXTBYTES);
fail_mask = (unsigned int) fail;
fail_mask >>= (sizeof(fail_mask) * 8U - 1U);
crypto_xof_shake256_init(&state);
crypto_xof_shake256_update(&state, z, 32);
crypto_xof_shake256_update(&state, ct, crypto_kem_mlkem768_CIPHERTEXTBYTES);
crypto_xof_shake256_squeeze(&state, k_bar, crypto_kem_mlkem768_SHAREDSECRETBYTES);
cmov(kr, k_bar, crypto_kem_mlkem768_SHAREDSECRETBYTES, (unsigned char) (fail != 0));
cmov(kr, k_bar, crypto_kem_mlkem768_SHAREDSECRETBYTES, (unsigned char) fail_mask);
memcpy(ss, kr, crypto_kem_mlkem768_SHAREDSECRETBYTES);