mirror of
https://github.com/luxfi/pulsar.git
synced 2026-09-24 00:25:52 +00:00
Pulsar v0.6.2: complete mlwe de-dup — route SHAKE samplers + ML-DSA ring core onto luxfi/mlwe (Phases 3+4, byte-preserving)
Finishes the Pulsar->luxfi/mlwe consolidation begun in v0.6.1 (transcript, Shamir). Phase 3 routes the FIPS-204 SHAKE samplers (ExpandA/ExpandS/ ExpandMask/SampleInBall) onto mlwe/sample/shake; Phase 4 routes the NTT/INTT/MulNTT ring core (and deletes the duplicate 256-entry zeta tables + montReduceLe2Q) onto mlwe/ring/mldsa. Both byte-identical by construction: mlwe was lifted verbatim from this package. Wire frame (bit-packers, a0+q Decompose/Power2Round) and FindHint/ no-makeHint (boundary.go) stay Pulsar-side — mlwe exposes those only via the normalized [0,q) interface, a different byte representation. GATE 3 + GATE 4: KAT byte-identical (9 keygen, 9 sign, 6 verify, 4 threshold-sign, 3 DKG); targeted suite 30/30; GATE-1/2, GATE A/B/C, capstone, Mithril RSS gold proof all green. Vector SHAs unchanged. Net -197 LOC.
This commit is contained in:
@@ -291,30 +291,6 @@ func bccSign(km *mldsaKeyMaterial, mode Mode, message, ctx []byte, rng io.Reader
|
||||
return nil, nil, ErrBCCExhausted
|
||||
}
|
||||
|
||||
// expandMaskPoly samples one polynomial of the FIPS 204 §7.3 ExpandMask
|
||||
// mask: coefficients uniform in (−γ1, γ1], drawn by unpacking a
|
||||
// γ1-bit-packed SHAKE-256(seed || (μ_index + nonce)) stream. This is the
|
||||
// FIPS 204 ML-DSA mask sampler, byte-identical to circl's polyDeriveUniformLeGamma1
|
||||
// over the same (seed, nonce) — it reuses the package's polyUnpackLeGamma1
|
||||
// unpacker so the BCC mask is the same distribution the FIPS signer uses.
|
||||
//
|
||||
// nonce is the per-poly index l (FIPS 204 uses κ + l; here the seed is
|
||||
// per-attempt and the within-attempt index is l, giving fresh masks per
|
||||
// attempt without a global counter).
|
||||
func expandMaskPoly(p *poly, seed *[64]byte, nonce uint16, gamma1Bits uint32) {
|
||||
var iv [66]byte
|
||||
copy(iv[:64], seed[:])
|
||||
iv[64] = byte(nonce)
|
||||
iv[65] = byte(nonce >> 8)
|
||||
h := sha3.NewShake256()
|
||||
_, _ = h.Write(iv[:])
|
||||
|
||||
polyLeGamma1Size := int((gamma1Bits + 1) * mldsaN / 8)
|
||||
buf := make([]byte, polyLeGamma1Size)
|
||||
_, _ = h.Read(buf)
|
||||
polyUnpackLeGamma1(p, buf, gamma1Bits)
|
||||
}
|
||||
|
||||
// polyVecExceeds reports whether any coefficient of v exceeds bound in
|
||||
// centered (FIPS 204 ‖·‖∞) magnitude — the rejection-sampling norm gate.
|
||||
func polyVecExceeds(v polyVec, bound uint32) bool {
|
||||
|
||||
@@ -141,13 +141,7 @@ func MithrilRSSKeygen(mode Mode, t, n int, partySeeds [][]byte) (*MithrilKey, er
|
||||
}
|
||||
|
||||
// A = ExpandA(rho), exactly as deriveKeyMaterial / circl.
|
||||
mk.a = make([]polyVec, K)
|
||||
for i := 0; i < K; i++ {
|
||||
mk.a[i] = make(polyVec, L)
|
||||
for j := 0; j < L; j++ {
|
||||
polyDeriveUniform(&mk.a[i][j], &mk.rho, uint16(i)<<8|uint16(j))
|
||||
}
|
||||
}
|
||||
mk.a = expandAPulsar(mk.rho, K, L)
|
||||
|
||||
// Per-subset short secret, sampled by the subset's leader; accumulate the
|
||||
// composite secret s1 = Σ_S s1^(S), s2 = Σ_S s2^(S).
|
||||
@@ -156,13 +150,8 @@ func MithrilRSSKeygen(mode Mode, t, n int, partySeeds [][]byte) (*MithrilKey, er
|
||||
for _, mask := range rss.EnumerateSubsets(t, n) {
|
||||
leader := rss.LeaderOf(mask)
|
||||
seed := mithrilSubsetSeed(partySeeds[leader], mask)
|
||||
ss := &mithrilSubsetSecret{mask: mask, s1: make(polyVec, L), s2: make(polyVec, K)}
|
||||
for i := 0; i < L; i++ {
|
||||
polyDeriveUniformLeqEta(&ss.s1[i], seed, uint16(i), eta)
|
||||
}
|
||||
for i := 0; i < K; i++ {
|
||||
polyDeriveUniformLeqEta(&ss.s2[i], seed, uint16(i+L), eta)
|
||||
}
|
||||
ss := &mithrilSubsetSecret{mask: mask}
|
||||
ss.s1, ss.s2 = expandSPulsar(*seed, K, L, int(eta))
|
||||
mk.subsets[mask] = ss
|
||||
for _, member := range rss.SubsetMembers(mask, n) {
|
||||
mk.holdings[member][mask] = ss
|
||||
|
||||
@@ -95,14 +95,8 @@ func deriveKeyMaterial(mode Mode, seed *[SeedSize]byte) (*mldsaKeyMaterial, erro
|
||||
return nil, ErrUnknownMode
|
||||
}
|
||||
var km mldsaKeyMaterial
|
||||
km.s1 = make(polyVec, L)
|
||||
km.s2 = make(polyVec, K)
|
||||
km.t0 = make(polyVec, K)
|
||||
km.t1 = make(polyVec, K)
|
||||
km.a = make([]polyVec, K)
|
||||
for i := range km.a {
|
||||
km.a[i] = make(polyVec, L)
|
||||
}
|
||||
|
||||
// FIPS 204: SHAKE-256(seed || K_byte || L_byte) → eSeed[128].
|
||||
var eSeed [128]byte
|
||||
@@ -116,20 +110,10 @@ func deriveKeyMaterial(mode Mode, seed *[SeedSize]byte) (*mldsaKeyMaterial, erro
|
||||
copy(sSeed[:], eSeed[32:96])
|
||||
copy(km.key[:], eSeed[96:128])
|
||||
|
||||
// Derive A from ρ: K × L block of polynomials.
|
||||
for i := 0; i < K; i++ {
|
||||
for j := 0; j < L; j++ {
|
||||
polyDeriveUniform(&km.a[i][j], &km.rho, uint16(i)<<8|uint16(j))
|
||||
}
|
||||
}
|
||||
|
||||
// Sample s1 (length L) and s2 (length K).
|
||||
for i := 0; i < L; i++ {
|
||||
polyDeriveUniformLeqEta(&km.s1[i], &sSeed, uint16(i), eta)
|
||||
}
|
||||
for i := 0; i < K; i++ {
|
||||
polyDeriveUniformLeqEta(&km.s2[i], &sSeed, uint16(i+L), eta)
|
||||
}
|
||||
// A = ExpandA(ρ) (K×L, NTT domain) and the secret vectors
|
||||
// s1, s2 = ExpandS(sSeed) — both via the canonical mlwe samplers.
|
||||
km.a = expandAPulsar(km.rho, K, L)
|
||||
km.s1, km.s2 = expandSPulsar(sSeed, K, L, int(eta))
|
||||
|
||||
// Compute t = A · s1 + s2 (NTT-domain mul, then InvNTT).
|
||||
s1Hat := make(polyVec, L)
|
||||
|
||||
@@ -22,27 +22,41 @@ package pulsar
|
||||
//
|
||||
// All primitives in this file are package-private; the public signing
|
||||
// surface lives in threshold.go and bcc_sign.go.
|
||||
//
|
||||
// The FIPS 204 SHAKE samplers (ExpandA/ExpandS/ExpandMask/SampleInBall)
|
||||
// that formerly lived here are now consumed from the canonical
|
||||
// github.com/luxfi/mlwe/sample/shake copy via the adapters in
|
||||
// mldsa_sample.go, and the NTT/INTT/MulNTT ring core (and its zeta
|
||||
// tables) from github.com/luxfi/mlwe/ring/mldsa via pulsarRing below —
|
||||
// both byte-identical, since mlwe/ring/mldsa was lifted from this file.
|
||||
// The remaining primitives here (raw add/sub, the reduceLe2Q/modQ
|
||||
// reductions, Decompose/Power2Round in the a₀+q wire representation, the
|
||||
// FIPS 204 bit-packers) stay Pulsar-side: mlwe exposes them only through
|
||||
// the normalized [0,q) Ring/RoundingRing interface, a different byte
|
||||
// representation than the wire frame and FindHint (boundary.go) require.
|
||||
|
||||
import (
|
||||
"encoding/binary"
|
||||
|
||||
"golang.org/x/crypto/sha3"
|
||||
"github.com/luxfi/mlwe"
|
||||
mldsaring "github.com/luxfi/mlwe/ring/mldsa"
|
||||
)
|
||||
|
||||
// pulsarRing is the canonical FIPS 204 ML-DSA ring core. NTT, INTT and
|
||||
// MulNTT are parameter-set-independent (they touch only N, q and the
|
||||
// zeta tables), so a single instance serves Pulsar-44/65/87.
|
||||
var pulsarRing = mldsaring.MustNew(mldsaring.Profile65)
|
||||
|
||||
// Ring parameters per FIPS 204 §4. These are fixed across all three
|
||||
// parameter sets (Pulsar-44, Pulsar-65, Pulsar-87).
|
||||
const (
|
||||
mldsaN = 256 // ring degree
|
||||
mldsaQ = 8380417 // 2²³ - 2¹³ + 1
|
||||
mldsaQinv = 4236238847 // -(q⁻¹) mod 2³²
|
||||
mldsaROver256 = 41978 // (256)⁻¹ · R² mod q, R = 2³²
|
||||
mldsaD = 13 // dropped low bits
|
||||
mldsaTRSize = 64 // FIPS 204 ML-DSA SHAKE-256 hash of pk
|
||||
mldsaCTildeSize = 48 // ML-DSA-65 c̃ length (λ=192 ⇒ λ/4)
|
||||
mldsaCTildeSize44 = 32 // ML-DSA-44 c̃ length (λ=128 ⇒ λ/4)
|
||||
mldsaCTildeSize87 = 64 // ML-DSA-87 c̃ length (λ=256 ⇒ λ/4)
|
||||
mldsaGamma2P65 = 261888 // (q-1)/32 for ML-DSA-65/87
|
||||
mldsaGamma2P44 = 95232 // (q-1)/88 for ML-DSA-44
|
||||
mldsaN = 256 // ring degree
|
||||
mldsaQ = 8380417 // 2²³ - 2¹³ + 1
|
||||
mldsaD = 13 // dropped low bits
|
||||
mldsaTRSize = 64 // FIPS 204 ML-DSA SHAKE-256 hash of pk
|
||||
mldsaCTildeSize = 48 // ML-DSA-65 c̃ length (λ=192 ⇒ λ/4)
|
||||
mldsaCTildeSize44 = 32 // ML-DSA-44 c̃ length (λ=128 ⇒ λ/4)
|
||||
mldsaCTildeSize87 = 64 // ML-DSA-87 c̃ length (λ=256 ⇒ λ/4)
|
||||
mldsaGamma2P65 = 261888 // (q-1)/32 for ML-DSA-65/87
|
||||
mldsaGamma2P44 = 95232 // (q-1)/88 for ML-DSA-44
|
||||
)
|
||||
|
||||
// poly is the ML-DSA polynomial in R_q = Z_q[X]/(X^256 + 1). Coefficients
|
||||
@@ -75,11 +89,15 @@ func le2qModQ(x uint32) uint32 {
|
||||
// modQ computes x mod q. Two-step reduction.
|
||||
func modQ(x uint32) uint32 { return le2qModQ(reduceLe2Q(x)) }
|
||||
|
||||
// montReduceLe2Q reduces x · R⁻¹ mod q assuming x · R ≤ q · 2³². The
|
||||
// result is in [0, 2q).
|
||||
func montReduceLe2Q(x uint64) uint32 {
|
||||
m := (x * mldsaQinv) & 0xffffffff
|
||||
return uint32((x + m*uint64(mldsaQ)) >> 32)
|
||||
// toMLWE widens Pulsar's [256]uint32 core into an mlwe.Poly for the
|
||||
// ring-core delegations (ntt/invNTT/mulHat) below. fromMLWE
|
||||
// (mldsa_sample.go) narrows back; both casts are lossless (< 2q < 2³²).
|
||||
func (p *poly) toMLWE() mlwe.Poly {
|
||||
c := make([]uint64, mldsaN)
|
||||
for i := 0; i < mldsaN; i++ {
|
||||
c[i] = uint64(p[i])
|
||||
}
|
||||
return mlwe.Poly{Coeffs: c}
|
||||
}
|
||||
|
||||
// power2round returns a₀ + q and a₁ with a = a₁·2^D + a₀ and -2^(D-1)
|
||||
@@ -147,13 +165,14 @@ func (p *poly) sub(a, b *poly) {
|
||||
}
|
||||
}
|
||||
|
||||
// polyMulHat sets p = a · b pointwise (NTT-domain pointwise mul).
|
||||
// Assumes a and b are in Montgomery form and coefficients sufficiently
|
||||
// small that a[i]·b[i] < 2³² · q.
|
||||
// mulHat sets p = a ∘ b, the NTT-domain pointwise Montgomery product,
|
||||
// via the canonical ring core (mlwe MulNTT). The CT Montgomery
|
||||
// convention is preserved exactly, so the multiply round-trip
|
||||
// INTT(MulNTT(NTT(a),NTT(b))) == a·b holds (see invNTT).
|
||||
func (p *poly) mulHat(a, b *poly) {
|
||||
for i := 0; i < mldsaN; i++ {
|
||||
p[i] = montReduceLe2Q(uint64(a[i]) * uint64(b[i]))
|
||||
}
|
||||
out := pulsarRing.NewPoly()
|
||||
pulsarRing.MulNTT(out, a.toMLWE(), b.toMLWE())
|
||||
*p = fromMLWE(out)
|
||||
}
|
||||
|
||||
// polyExceeds reports whether the "supnorm" of p (max central-rep
|
||||
@@ -204,236 +223,27 @@ func polyDotHat(p *poly, a, b polyVec) {
|
||||
}
|
||||
}
|
||||
|
||||
// nttZetas / nttInvZetas: powers of the 512th root of unity zeta=1753
|
||||
// in Montgomery form per FIPS 204 §3.6. These are the canonical FIPS
|
||||
// 204 NTT constants, byte-identical to circl/internal/dilithium.Zetas
|
||||
// and InvZetas.
|
||||
var nttZetas = [mldsaN]uint32{
|
||||
4193792, 25847, 5771523, 7861508, 237124, 7602457, 7504169,
|
||||
466468, 1826347, 2353451, 8021166, 6288512, 3119733, 5495562,
|
||||
3111497, 2680103, 2725464, 1024112, 7300517, 3585928, 7830929,
|
||||
7260833, 2619752, 6271868, 6262231, 4520680, 6980856, 5102745,
|
||||
1757237, 8360995, 4010497, 280005, 2706023, 95776, 3077325,
|
||||
3530437, 6718724, 4788269, 5842901, 3915439, 4519302, 5336701,
|
||||
3574422, 5512770, 3539968, 8079950, 2348700, 7841118, 6681150,
|
||||
6736599, 3505694, 4558682, 3507263, 6239768, 6779997, 3699596,
|
||||
811944, 531354, 954230, 3881043, 3900724, 5823537, 2071892,
|
||||
5582638, 4450022, 6851714, 4702672, 5339162, 6927966, 3475950,
|
||||
2176455, 6795196, 7122806, 1939314, 4296819, 7380215, 5190273,
|
||||
5223087, 4747489, 126922, 3412210, 7396998, 2147896, 2715295,
|
||||
5412772, 4686924, 7969390, 5903370, 7709315, 7151892, 8357436,
|
||||
7072248, 7998430, 1349076, 1852771, 6949987, 5037034, 264944,
|
||||
508951, 3097992, 44288, 7280319, 904516, 3958618, 4656075,
|
||||
8371839, 1653064, 5130689, 2389356, 8169440, 759969, 7063561,
|
||||
189548, 4827145, 3159746, 6529015, 5971092, 8202977, 1315589,
|
||||
1341330, 1285669, 6795489, 7567685, 6940675, 5361315, 4499357,
|
||||
4751448, 3839961, 2091667, 3407706, 2316500, 3817976, 5037939,
|
||||
2244091, 5933984, 4817955, 266997, 2434439, 7144689, 3513181,
|
||||
4860065, 4621053, 7183191, 5187039, 900702, 1859098, 909542,
|
||||
819034, 495491, 6767243, 8337157, 7857917, 7725090, 5257975,
|
||||
2031748, 3207046, 4823422, 7855319, 7611795, 4784579, 342297,
|
||||
286988, 5942594, 4108315, 3437287, 5038140, 1735879, 203044,
|
||||
2842341, 2691481, 5790267, 1265009, 4055324, 1247620, 2486353,
|
||||
1595974, 4613401, 1250494, 2635921, 4832145, 5386378, 1869119,
|
||||
1903435, 7329447, 7047359, 1237275, 5062207, 6950192, 7929317,
|
||||
1312455, 3306115, 6417775, 7100756, 1917081, 5834105, 7005614,
|
||||
1500165, 777191, 2235880, 3406031, 7838005, 5548557, 6709241,
|
||||
6533464, 5796124, 4656147, 594136, 4603424, 6366809, 2432395,
|
||||
2454455, 8215696, 1957272, 3369112, 185531, 7173032, 5196991,
|
||||
162844, 1616392, 3014001, 810149, 1652634, 4686184, 6581310,
|
||||
5341501, 3523897, 3866901, 269760, 2213111, 7404533, 1717735,
|
||||
472078, 7953734, 1723600, 6577327, 1910376, 6712985, 7276084,
|
||||
8119771, 4546524, 5441381, 6144432, 7959518, 6094090, 183443,
|
||||
7403526, 1612842, 4834730, 7826001, 3919660, 8332111, 7018208,
|
||||
3937738, 1400424, 7534263, 1976782,
|
||||
}
|
||||
|
||||
var nttInvZetas = [mldsaN]uint32{
|
||||
6403635, 846154, 6979993, 4442679, 1362209, 48306, 4460757,
|
||||
554416, 3545687, 6767575, 976891, 8196974, 2286327, 420899,
|
||||
2235985, 2939036, 3833893, 260646, 1104333, 1667432, 6470041,
|
||||
1803090, 6656817, 426683, 7908339, 6662682, 975884, 6167306,
|
||||
8110657, 4513516, 4856520, 3038916, 1799107, 3694233, 6727783,
|
||||
7570268, 5366416, 6764025, 8217573, 3183426, 1207385, 8194886,
|
||||
5011305, 6423145, 164721, 5925962, 5948022, 2013608, 3776993,
|
||||
7786281, 3724270, 2584293, 1846953, 1671176, 2831860, 542412,
|
||||
4974386, 6144537, 7603226, 6880252, 1374803, 2546312, 6463336,
|
||||
1279661, 1962642, 5074302, 7067962, 451100, 1430225, 3318210,
|
||||
7143142, 1333058, 1050970, 6476982, 6511298, 2994039, 3548272,
|
||||
5744496, 7129923, 3767016, 6784443, 5894064, 7132797, 4325093,
|
||||
7115408, 2590150, 5688936, 5538076, 8177373, 6644538, 3342277,
|
||||
4943130, 4272102, 2437823, 8093429, 8038120, 3595838, 768622,
|
||||
525098, 3556995, 5173371, 6348669, 3122442, 655327, 522500,
|
||||
43260, 1613174, 7884926, 7561383, 7470875, 6521319, 7479715,
|
||||
3193378, 1197226, 3759364, 3520352, 4867236, 1235728, 5945978,
|
||||
8113420, 3562462, 2446433, 6136326, 3342478, 4562441, 6063917,
|
||||
4972711, 6288750, 4540456, 3628969, 3881060, 3019102, 1439742,
|
||||
812732, 1584928, 7094748, 7039087, 7064828, 177440, 2409325,
|
||||
1851402, 5220671, 3553272, 8190869, 1316856, 7620448, 210977,
|
||||
5991061, 3249728, 6727353, 8578, 3724342, 4421799, 7475901,
|
||||
1100098, 8336129, 5282425, 7871466, 8115473, 3343383, 1430430,
|
||||
6527646, 7031341, 381987, 1308169, 22981, 1228525, 671102,
|
||||
2477047, 411027, 3693493, 2967645, 5665122, 6232521, 983419,
|
||||
4968207, 8253495, 3632928, 3157330, 3190144, 1000202, 4083598,
|
||||
6441103, 1257611, 1585221, 6203962, 4904467, 1452451, 3041255,
|
||||
3677745, 1528703, 3930395, 2797779, 6308525, 2556880, 4479693,
|
||||
4499374, 7426187, 7849063, 7568473, 4680821, 1600420, 2140649,
|
||||
4873154, 3821735, 4874723, 1643818, 1699267, 539299, 6031717,
|
||||
300467, 4840449, 2867647, 4805995, 3043716, 3861115, 4464978,
|
||||
2537516, 3592148, 1661693, 4849980, 5303092, 8284641, 5674394,
|
||||
8100412, 4369920, 19422, 6623180, 3277672, 1399561, 3859737,
|
||||
2118186, 2108549, 5760665, 1119584, 549488, 4794489, 1079900,
|
||||
7356305, 5654953, 5700314, 5268920, 2884855, 5260684, 2091905,
|
||||
359251, 6026966, 6554070, 7913949, 876248, 777960, 8143293,
|
||||
518909, 2608894, 8354570, 4186625,
|
||||
}
|
||||
|
||||
// polyNTT executes the in-place forward NTT on p. Assumes coefficients
|
||||
// are in Montgomery representation and bounded by 2q. Output coefficients
|
||||
// bounded by 18q.
|
||||
// ntt executes the in-place forward NTT on p via the canonical ring core
|
||||
// (mlwe NTT). Output coefficients are left unreduced (< 18q), exactly as
|
||||
// the verbatim core, for the multiply chain (mulHat, invNTT) to consume.
|
||||
func (p *poly) ntt() {
|
||||
k := 0
|
||||
for l := uint(mldsaN / 2); l > 0; l >>= 1 {
|
||||
for offset := uint(0); offset < mldsaN-l; offset += 2 * l {
|
||||
k++
|
||||
zeta := uint64(nttZetas[k])
|
||||
for j := offset; j < offset+l; j++ {
|
||||
t := montReduceLe2Q(zeta * uint64(p[j+l]))
|
||||
p[j+l] = p[j] + (2*mldsaQ - t)
|
||||
p[j] += t
|
||||
}
|
||||
}
|
||||
}
|
||||
mp := p.toMLWE()
|
||||
pulsarRing.NTT(mp)
|
||||
*p = fromMLWE(mp)
|
||||
}
|
||||
|
||||
// polyInvNTT executes the in-place inverse NTT on p and multiplies by
|
||||
// the Montgomery factor R. Coefficients in Montgomery form, bounded by
|
||||
// 2q.
|
||||
// invNTT executes the inverse NTT on p via the canonical ring core (mlwe
|
||||
// INTT): it reduces to < 2q first and normalizes into [0, q) after, per
|
||||
// the mlwe RoundingRing contract. CT Montgomery convention — the bare
|
||||
// round-trip INTT(NTT(p)) == R·p (R = 2³² mod q), NOT p; the real
|
||||
// contract is the multiply round-trip INTT(MulNTT(NTT(a),NTT(b))) == a·b.
|
||||
// Every Pulsar caller already normalizes after invNTT (only
|
||||
// congruence-preserving add/sub intervene), so the bundled reduce/
|
||||
// normalize is byte-identical to the former hand-reduced sequence.
|
||||
func (p *poly) invNTT() {
|
||||
k := 0
|
||||
for l := uint(1); l < mldsaN; l <<= 1 {
|
||||
for offset := uint(0); offset < mldsaN-l; offset += 2 * l {
|
||||
zeta := uint64(nttInvZetas[k])
|
||||
k++
|
||||
for j := offset; j < offset+l; j++ {
|
||||
t := p[j]
|
||||
p[j] = t + p[j+l]
|
||||
t += 256*mldsaQ - p[j+l]
|
||||
p[j+l] = montReduceLe2Q(zeta * uint64(t))
|
||||
}
|
||||
}
|
||||
}
|
||||
for j := 0; j < mldsaN; j++ {
|
||||
p[j] = montReduceLe2Q(mldsaROver256 * uint64(p[j]))
|
||||
}
|
||||
}
|
||||
|
||||
// polyDeriveUniform samples p uniformly from SHAKE-128(seed || nonce).
|
||||
// Output normalised in [0, q).
|
||||
func polyDeriveUniform(p *poly, seed *[32]byte, nonce uint16) {
|
||||
var iv [34]byte
|
||||
copy(iv[:32], seed[:])
|
||||
iv[32] = byte(nonce)
|
||||
iv[33] = byte(nonce >> 8)
|
||||
h := sha3.NewShake128()
|
||||
_, _ = h.Write(iv[:])
|
||||
var buf [168]byte
|
||||
i := 0
|
||||
for i < mldsaN {
|
||||
_, _ = h.Read(buf[:])
|
||||
for j := 0; j+3 <= 168 && i < mldsaN; j += 3 {
|
||||
t := (uint32(buf[j]) | (uint32(buf[j+1]) << 8) | (uint32(buf[j+2]) << 16)) & 0x7fffff
|
||||
if t < mldsaQ {
|
||||
p[i] = t
|
||||
i++
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// polyDeriveUniformLeqEta samples p with coefficients in [-η, η]
|
||||
// (centred-rep). Output stored in [q-η, q+η] (un-normalised).
|
||||
func polyDeriveUniformLeqEta(p *poly, seed *[64]byte, nonce uint16, eta uint32) {
|
||||
var iv [66]byte
|
||||
copy(iv[:64], seed[:])
|
||||
iv[64] = byte(nonce)
|
||||
iv[65] = byte(nonce >> 8)
|
||||
h := sha3.NewShake256()
|
||||
_, _ = h.Write(iv[:])
|
||||
var buf [136]byte
|
||||
i := 0
|
||||
for i < mldsaN {
|
||||
_, _ = h.Read(buf[:])
|
||||
for j := 0; j < 136 && i < mldsaN; j++ {
|
||||
t1 := uint32(buf[j]) & 15
|
||||
t2 := uint32(buf[j]) >> 4
|
||||
if eta == 2 {
|
||||
if t1 <= 14 {
|
||||
t1 -= ((205 * t1) >> 10) * 5
|
||||
p[i] = mldsaQ + eta - t1
|
||||
i++
|
||||
}
|
||||
if t2 <= 14 && i < mldsaN {
|
||||
t2 -= ((205 * t2) >> 10) * 5
|
||||
p[i] = mldsaQ + eta - t2
|
||||
i++
|
||||
}
|
||||
} else if eta == 4 {
|
||||
if t1 <= 2*eta {
|
||||
p[i] = mldsaQ + eta - t1
|
||||
i++
|
||||
}
|
||||
if t2 <= 2*eta && i < mldsaN {
|
||||
p[i] = mldsaQ + eta - t2
|
||||
i++
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// polyUnpackLeGamma1 unpacks a γ₁-bit-packed polynomial from buf into p
|
||||
// (centered uniform in (-γ₁, γ₁]). gamma1Bits is 17 or 19. Output
|
||||
// normalised in [0, q).
|
||||
func polyUnpackLeGamma1(p *poly, buf []byte, gamma1Bits uint32) {
|
||||
gamma1 := uint32(1) << gamma1Bits
|
||||
if gamma1Bits == 17 {
|
||||
j := 0
|
||||
size := (17 + 1) * mldsaN / 8
|
||||
for i := 0; i+9 <= size; i += 9 {
|
||||
p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | (uint32(buf[i+2]&0x3) << 16)
|
||||
p1 := uint32(buf[i+2]>>2) | (uint32(buf[i+3]) << 6) | (uint32(buf[i+4]&0xf) << 14)
|
||||
p2 := uint32(buf[i+4]>>4) | (uint32(buf[i+5]) << 4) | (uint32(buf[i+6]&0x3f) << 12)
|
||||
p3 := uint32(buf[i+6]>>6) | (uint32(buf[i+7]) << 2) | (uint32(buf[i+8]) << 10)
|
||||
p0 = gamma1 - p0
|
||||
p1 = gamma1 - p1
|
||||
p2 = gamma1 - p2
|
||||
p3 = gamma1 - p3
|
||||
p0 += uint32(int32(p0)>>31) & mldsaQ
|
||||
p1 += uint32(int32(p1)>>31) & mldsaQ
|
||||
p2 += uint32(int32(p2)>>31) & mldsaQ
|
||||
p3 += uint32(int32(p3)>>31) & mldsaQ
|
||||
p[j] = p0
|
||||
p[j+1] = p1
|
||||
p[j+2] = p2
|
||||
p[j+3] = p3
|
||||
j += 4
|
||||
}
|
||||
} else if gamma1Bits == 19 {
|
||||
j := 0
|
||||
size := (19 + 1) * mldsaN / 8
|
||||
for i := 0; i+5 <= size; i += 5 {
|
||||
p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | (uint32(buf[i+2]&0xf) << 16)
|
||||
p1 := uint32(buf[i+2]>>4) | (uint32(buf[i+3]) << 4) | (uint32(buf[i+4]) << 12)
|
||||
p0 = gamma1 - p0
|
||||
p1 = gamma1 - p1
|
||||
p0 += uint32(int32(p0)>>31) & mldsaQ
|
||||
p1 += uint32(int32(p1)>>31) & mldsaQ
|
||||
p[j] = p0
|
||||
p[j+1] = p1
|
||||
j += 2
|
||||
}
|
||||
}
|
||||
mp := p.toMLWE()
|
||||
pulsarRing.INTT(mp)
|
||||
*p = fromMLWE(mp)
|
||||
}
|
||||
|
||||
// polyPackLeGamma1 packs p (coefficients in (-γ₁, γ₁]) into buf using
|
||||
@@ -481,39 +291,6 @@ func polyPackLeGamma1(p *poly, buf []byte, gamma1Bits uint32) {
|
||||
}
|
||||
}
|
||||
|
||||
// polyDeriveUniformBall samples p with τ non-zero coefficients in {-1, +1}
|
||||
// using SHAKE-256(seed). Implementation follows FIPS 204 SampleInBall.
|
||||
func polyDeriveUniformBall(p *poly, seed []byte, tau int) {
|
||||
var buf [136]byte
|
||||
h := sha3.NewShake256()
|
||||
_, _ = h.Write(seed)
|
||||
_, _ = h.Read(buf[:])
|
||||
|
||||
signs := binary.LittleEndian.Uint64(buf[:8])
|
||||
bufOff := 8
|
||||
|
||||
*p = poly{}
|
||||
for i := uint16(mldsaN - uint16(tau)); i < mldsaN; i++ {
|
||||
var b uint16
|
||||
for {
|
||||
if bufOff >= 136 {
|
||||
_, _ = h.Read(buf[:])
|
||||
bufOff = 0
|
||||
}
|
||||
b = uint16(buf[bufOff])
|
||||
bufOff++
|
||||
if b <= i {
|
||||
break
|
||||
}
|
||||
}
|
||||
p[i] = p[b]
|
||||
p[b] = 1
|
||||
// XOR-trick: 1 ^ (1 | (Q-1)) = Q-1.
|
||||
p[b] ^= uint32((-(signs & 1)) & (1 | (mldsaQ - 1)))
|
||||
signs >>= 1
|
||||
}
|
||||
}
|
||||
|
||||
// polyPackT1 packs p (coefficients ≤ 2^(QBits-D) = 2^10) into buf at
|
||||
// 10 bits per coefficient. PolyT1Size = N · (QBits-D) / 8 = N · 10/8 = 320.
|
||||
func polyPackT1(p *poly, buf []byte) {
|
||||
|
||||
@@ -0,0 +1,91 @@
|
||||
// Copyright (C) 2025-2026, Lux Industries Inc. All rights reserved.
|
||||
// See the file LICENSE for licensing terms.
|
||||
|
||||
package pulsar
|
||||
|
||||
// mldsa_sample.go — Pulsar consumes the FIPS 204 SHAKE samplers (ExpandA,
|
||||
// ExpandS, ExpandMask, SampleInBall) from the canonical
|
||||
// github.com/luxfi/mlwe/sample/shake copy. That package was lifted
|
||||
// verbatim, at the value level, from this package's former hand-rolled
|
||||
// samplers, so routing through it is byte-identical BY CONSTRUCTION: a
|
||||
// public key or signature produced via these adapters is the exact same
|
||||
// bytes as before the de-dup.
|
||||
//
|
||||
// This file is the only Pulsar<->mlwe sampler bridge: it holds the
|
||||
// uint64<->uint32 poly converter and the four FIPS 204 sampler entry
|
||||
// points in Pulsar's own poly/polyVec shapes. ExpandA and ExpandS are
|
||||
// consumed in their natural matrix/vector form (the nonce schedule
|
||||
// i<<8|j and i / i+L is internal to mlwe). ExpandMask and SampleInBall
|
||||
// keep per-poly Pulsar-named entries because callers — and the no-leak /
|
||||
// transcript tests — invoke them per polynomial; the single-poly mask is
|
||||
// recovered from the vector sampler with an L=1 profile and kappa=nonce,
|
||||
// which samples exactly poly index nonce.
|
||||
|
||||
import (
|
||||
"github.com/luxfi/mlwe"
|
||||
"github.com/luxfi/mlwe/sample/shake"
|
||||
)
|
||||
|
||||
// fromMLWE narrows an mlwe.Poly (uint64 coefficients) into Pulsar's
|
||||
// [256]uint32 core. Every sampler output is < 2q < 2^32, so the cast is
|
||||
// lossless.
|
||||
func fromMLWE(m mlwe.Poly) poly {
|
||||
var out poly
|
||||
for i := 0; i < mldsaN; i++ {
|
||||
out[i] = uint32(m.Coeffs[i])
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// expandAPulsar derives Pulsar's public matrix A = ExpandA(rho)
|
||||
// (FIPS 204 §3.5): K×L polynomials sampled directly in the NTT
|
||||
// (evaluation) domain, byte-identical to circl's stored pk.A and to
|
||||
// deriveKeyMaterial's km.a. The FIPS 204 nonce schedule i<<8|j is
|
||||
// internal to mlwe.ExpandA.
|
||||
func expandAPulsar(rho [32]byte, K, L int) []polyVec {
|
||||
am := shake.ExpandA(mlwe.Profile{N: mldsaN, Q: mldsaQ, K: K, L: L}, rho)
|
||||
a := make([]polyVec, K)
|
||||
for i := 0; i < K; i++ {
|
||||
a[i] = make(polyVec, L)
|
||||
for j := 0; j < L; j++ {
|
||||
a[i][j] = fromMLWE(am[i][j])
|
||||
}
|
||||
}
|
||||
return a
|
||||
}
|
||||
|
||||
// expandSPulsar samples the secret vectors s1 (length L) and s2 (length
|
||||
// K) from a 64-byte seed via the FIPS 204 centered-binomial sampler
|
||||
// (ExpandS), with coefficients in the χ_η representation [q-η, q+η]. The
|
||||
// nonce schedule (i for s1, i+L for s2) is internal to mlwe.ExpandS.
|
||||
func expandSPulsar(rhoPrime [64]byte, K, L, eta int) (s1, s2 polyVec) {
|
||||
s1m, s2m := shake.ExpandS(mlwe.Profile{N: mldsaN, Q: mldsaQ, K: K, L: L, Eta: eta}, rhoPrime)
|
||||
s1 = make(polyVec, len(s1m))
|
||||
for i := range s1m {
|
||||
s1[i] = fromMLWE(s1m[i])
|
||||
}
|
||||
s2 = make(polyVec, len(s2m))
|
||||
for i := range s2m {
|
||||
s2[i] = fromMLWE(s2m[i])
|
||||
}
|
||||
return s1, s2
|
||||
}
|
||||
|
||||
// expandMaskPoly fills p with one FIPS 204 ExpandMask polynomial —
|
||||
// coefficients uniform in (-γ1, γ1], drawn from SHAKE-256(seed || nonce)
|
||||
// — via the canonical mlwe sampler. mlwe exposes ExpandMask per vector;
|
||||
// the single-poly form is recovered with an L=1 profile and kappa=nonce,
|
||||
// which samples exactly poly index nonce. nonce is the per-poly index l
|
||||
// (the per-attempt seed carries the round entropy, so no global κ).
|
||||
func expandMaskPoly(p *poly, seed *[64]byte, nonce uint16, gamma1Bits uint32) {
|
||||
y := shake.ExpandMask(mlwe.Profile{N: mldsaN, Q: mldsaQ, L: 1, Gamma1: uint32(1) << gamma1Bits}, *seed, nonce)
|
||||
*p = fromMLWE(y[0])
|
||||
}
|
||||
|
||||
// polyDeriveUniformBall fills p with the FIPS 204 SampleInBall challenge
|
||||
// (τ nonzero ±1 coefficients, -1 stored as q-1) for seed, via the
|
||||
// canonical mlwe sampler. SampleInBall is naturally per-poly, so this is
|
||||
// a 1:1 adapter.
|
||||
func polyDeriveUniformBall(p *poly, seed []byte, tau int) {
|
||||
*p = fromMLWE(shake.SampleInBall(mlwe.Profile{N: mldsaN, Q: mldsaQ, Tau: tau}, seed))
|
||||
}
|
||||
@@ -52,20 +52,6 @@ var ErrVSSDKGScope = errors.New(
|
||||
"pulsar: dealerless VSS DKG is wired for ML-DSA-65 only (luxfi/dkg ships ring.MLDSA65(); " +
|
||||
"ML-DSA-87 needs an MLDSA87 profile upstream)")
|
||||
|
||||
// expandAPulsar derives pulsar's public matrix A = ExpandA(rho) (FIPS-204 §3.5),
|
||||
// K×L polynomials in pulsar's NTT-Montgomery domain — byte-identical to circl's
|
||||
// stored pk.A and to deriveKeyMaterial's km.a.
|
||||
func expandAPulsar(rho [32]byte, K, L int) []polyVec {
|
||||
a := make([]polyVec, K)
|
||||
for i := 0; i < K; i++ {
|
||||
a[i] = make(polyVec, L)
|
||||
for j := 0; j < L; j++ {
|
||||
polyDeriveUniform(&a[i][j], &rho, uint16(i)<<8|uint16(j))
|
||||
}
|
||||
}
|
||||
return a
|
||||
}
|
||||
|
||||
// aCoeffFromPulsarA recovers A in convention-neutral STANDARD coefficient form by
|
||||
// the unit-vector multiply A·e_j through pulsar's own (circl-correct) pipeline —
|
||||
// the same extraction the pin-4 KAT validated. (A·e_j)[i] = A[i][j], so no
|
||||
|
||||
Reference in New Issue
Block a user