archives/zig
1
0
Fork 0
mirror of https://codeberg.org/ziglang/zig.git synced 2026-03-08 02:24:33 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge pull request 'crypto.mlkem: return J(z||c) on implicit rejection' (#30155) from jedisct1/zig:mlkemrej into master

Browse source 
Reviewed-on: https://codeberg.org/ziglang/zig/pulls/30155
This commit is contained in:
jedisct1 2025-12-09 16:28:14 +01:00
commit d27c804d9f
1 changed files with 9 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

16
lib/std/crypto/ml_kem.zig
View file

@ -329,17 +329,19 @@ fn Kyber(comptime p: Params) type {
// ct' = innerEnc(pk, m', r')
const ct2 = sk.pk.encrypt(&m2, kr2[32..64]);
// Compute H(ct) and put in the second slot of kr2 which will be (K'', H(ct)).
sha3.Sha3_256.hash(ct, kr2[32..], .{});
// Replace K'' by z in the first slot of kr2 if ct ≠ ct'.
cmov(32, kr2[0..32], sk.z, ctneq(ciphertext_length, ct.*, ct2));
if (p.ml_kem) {
// ML-KEM: K = K''/z
// ML-KEM: K = K'' if ct == ct', else K = J(z || c) per FIPS 203
var k_bar: [shared_length]u8 = undefined;
var j = sha3.Shake256.init(.{});
j.update(&sk.z);
j.update(ct);
j.squeeze(&k_bar);
cmov(shared_length, kr2[0..shared_length], k_bar, ctneq(ciphertext_length, ct.*, ct2));
return kr2[0..shared_length].*;
} else {
// Kyber: K = KDF(K''/z ‖ H(c))
sha3.Sha3_256.hash(ct, kr2[32..], .{});
cmov(32, kr2[0..32], sk.z, ctneq(ciphertext_length, ct.*, ct2));
var ss: [shared_length]u8 = undefined;
sha3.Shake256.hash(&kr2, &ss, .{});
return ss;