mirror of
https://github.com/luxfi/crypto.git
synced 2026-10-30 16:59:13 +00:00
zeekay
4edbaa6a3e
Empirical constant-time analysis harness mirroring the Pulsar
pack at ~/work/lux/pulsar/ct/dudect/:
keygen_ct.go + dudect_keygen.c - cgo bridge + C main loop
encaps_ct.go + dudect_encaps.c - encaps + tape
decaps_ct.go + dudect_decaps.c - the CT-critical routine
CT population:
- All classes are VALID invocations of the routine under test
- Decaps: both classes are VALID ciphertexts on a pool of valid
encryptions under the same secret key. Any timing difference
is a real ciphertext-content signal (FO-K timing attack
surface).
All three cgo shared libraries build clean:
GOWORK=off go build -buildmode=c-shared -tags mlkem_keygen_ct
GOWORK=off go build -buildmode=c-shared -tags mlkem_encaps_ct
GOWORK=off go build -buildmode=c-shared -tags mlkem_decaps_ct
Submission-grade run pending (GATE-1 in CRYPTOGRAPHER-SIGN-OFF.md).
Expected verdict for all three routines is no leakage detected
because Lux wraps cloudflare/circl which is BoringSSL/libjade-grade CT.
35 lines
1.3 KiB
Bash
Executable File
35 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fetch dudect at the pinned commit used by Pulsar's constant-time
|
|
# track.
|
|
#
|
|
# dudect (https://github.com/oreparaz/dudect) is a single-header
|
|
# leakage-detection library. We do not vendor dudect.h into this
|
|
# repository — this script reproduces it on demand.
|
|
#
|
|
# Pinned hash at submission-tag time. Update at the same time as the
|
|
# Pulsar submission tag so the artifact chain stays reproducible.
|
|
|
|
set -euo pipefail
|
|
|
|
# Repo + commit (master HEAD as of the dudect harness scaffold land).
|
|
# Update when bumping the submission tag.
|
|
DUDECT_REPO="https://github.com/oreparaz/dudect.git"
|
|
DUDECT_COMMIT="master"
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
cd "$SCRIPT_DIR"
|
|
|
|
if [[ -d dudect/.git ]]; then
|
|
echo "==> dudect already cloned at $SCRIPT_DIR/dudect"
|
|
( cd dudect && git fetch --quiet origin && git checkout --quiet "$DUDECT_COMMIT" )
|
|
else
|
|
echo "==> cloning dudect at $DUDECT_COMMIT"
|
|
git clone --quiet "$DUDECT_REPO" dudect
|
|
( cd dudect && git checkout --quiet "$DUDECT_COMMIT" )
|
|
fi
|
|
|
|
# The header we link against is dudect/src/dudect.h. Stamp the resolved
|
|
# revision so reviewers can verify the artifact chain.
|
|
RESOLVED_REV="$(cd dudect && git rev-parse HEAD)"
|
|
echo "==> dudect.h ready at $SCRIPT_DIR/dudect/src/dudect.h (rev $RESOLVED_REV)"
|