Add ML-KEM (FIPS 203). #470

bwesterb · 2024-01-04T17:46:12Z

Implementation of ML-KEM (FIPS 203).

We keep Kyber around (for now) as it's currently widely deployed. Code differences between them are minimal anyway.

Changes from IPD:

Add test against ACVP test vectors — ~~which still have to be updated to match FIPS203.~~ are updated
Add domain separation in internal PKE key generation.
Add modulus check on public key.

Lekensteyn

Lots of nits, the only really "wrong" thing is a documentation comment.

LGTM otherwise!

kem/kyber/templates/pkg.templ.go

Lekensteyn · 2024-02-15T14:03:44Z

kem/kyber/templates/pkg.templ.go

@@ -143,6 +151,9 @@ func (pk *PublicKey) EncapsulateTo(ct, ss []byte, seed []byte) {
 	// c = Kyber.CPAPKE.Enc(pk, m, r)
 	pk.pk.EncryptTo(ct, m[:], kr[32:])


While at it, maybe we can use a name for this constant. This matches the type of K in the Algorithm 16 from FIPS 203 ("derive shared secret K and randomness r") and is consistent with your other use of kr[:SharedKeySize] below.

Suggested change

pk.pk.EncryptTo(ct, m[:], kr[32:])

pk.pk.EncryptTo(ct, m[:], kr[SharedKeySize:])

This is accidental, and that 32 is not the shared key size.

I am not following.

My understanding is that the first part of kr is the shared secret key. So kr[SharedKeySize:] would skip the shared secret key, and refer to the remaining part, r.

Output: shared key K ∈ B32

(K, r) ← G(m ∥ H(ek)) ▷ derive shared secret key K and randomness r c ← K-PKE.Encrypt(ek, m, r) ▷ encrypt m using K-PKE with randomness r

In Kyber the first 32 bytes does not contain the returned shared secret, but an intermediate key that happens to be 32 bytes as well.

In that case, what about replacing kr[:SharedKeySize] by kr[:32] to avoid that implication?

kem/kyber/templates/pkg.templ.go

bwesterb · 2024-02-15T14:44:49Z

Lots of nits, the only really "wrong" thing is a documentation comment.

Thanks. Addressed.

mvd-ows · 2024-07-04T11:01:14Z

Any updates on this? Is there something that prevents it from being merged?

Our view is that the "draft" status will probably remain for some time to come. Hopefully we can see this merged before the draft label is removed.

bwesterb · 2024-07-04T11:11:10Z

Is there something that prevents it from being merged?

ML-KEM is not final and could well have a breaking change compared to the initial public draft which is implemented by this PR.

Our view is that the "draft" status will probably remain for some time to come.

We expect the final version of ML-KEM this year, and that could be as early as this month.

mvd-ows · 2024-07-04T11:13:12Z

Thank you for those clarifications, and the quick reply.

armfazh · 2024-07-05T21:20:23Z

kem/kyber/gen.go

@@ -7,8 +7,10 @@ package main



Could you please move these files used to generate code to an internal folder.

/kem/internal/gen.go /kem/internal/pkg.templ.go

Generated packages:

/kem/kyber* /kem/mlkem*

Could you please move these files used to generate code to an internal folder.

Shall we do that in a separate PR? It's not only Kyber that has a gen.go outside of an internal.

Lekensteyn · 2024-08-13T13:53:48Z

kem/mlkem/acvp_test.go

+					t.Fatal(err)
+				}
+
+				if dk.Equal(dk2) {


Based on the error message, aren't these two conditions inverted?

Suggested change

if dk.Equal(dk2) {

if !dk.Equal(dk2) {

Oof. Well spotted. Let me figure out why it fails...

Ok, apparently the ACVP test vectors haven't been updated yet.

armfazh · 2024-08-13T18:25:40Z

pke/kyber/templates/pkg.templ.go

+// key is not normalized.
+func (pk *PublicKey) UnpackMLKEM(buf []byte) error {
+	if len(buf) != PublicKeySize {
+		return kem.ErrPubKeySize


The previous Pack/Unpack function panics instead of returning an error when the size does not match.

We keep Kyber around (for now) as it's currently widely deployed. Code differences between them are minimal anyway. Tests against NIST's ACVP test vectors.

…605) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/cloudflare/circl](https://github.com/cloudflare/circl) | indirect | minor | `v1.3.7` -> `v1.6.1` | --- ### CIRCL-Fourq: Missing and wrong validation can lead to incorrect results [GHSA-2x5j-vhc8-9cwm](GHSA-2x5j-vhc8-9cwm) / [GO-2025-3754](https://pkg.go.dev/vuln/GO-2025-3754) <details> <summary>More information</summary> #### Details ##### Impact The CIRCL implementation of FourQ fails to validate user-supplied low-order points during Diffie-Hellman key exchange, potentially allowing attackers to force the identity point and compromise session security. Moreover, there is an incorrect point validation in ScalarMult can lead to incorrect results in the isEqual function and if a point is on the curve. ##### Patches Version 1.6.1 (https://github.com/cloudflare/circl/tree/v1.6.1) mitigates the identified issues. We acknowledge Alon Livne (Botanica Software Labs) for the reported findings. #### Severity Low #### References - [https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm](https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm) - [https://github.com/cloudflare/circl](https://github.com/cloudflare/circl) - [https://github.com/cloudflare/circl/tree/v1.6.1](https://github.com/cloudflare/circl/tree/v1.6.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-2x5j-vhc8-9cwm) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl [GHSA-2x5j-vhc8-9cwm](GHSA-2x5j-vhc8-9cwm) / [GO-2025-3754](https://pkg.go.dev/vuln/GO-2025-3754) <details> <summary>More information</summary> #### Details CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl #### Severity Unknown #### References - [https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm](https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm) - [https://github.com/cloudflare/circl/tree/v1.6.1](https://github.com/cloudflare/circl/tree/v1.6.1) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2025-3754) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>cloudflare/circl (github.com/cloudflare/circl)</summary> ### [`v1.6.1`](https://github.com/cloudflare/circl/releases/tag/v1.6.1): CIRCL v1.6.1 [Compare Source](cloudflare/circl@v1.6.0...v1.6.1) #### CIRCL v1.6.1 - Fixes some point checks on the FourQ curve. - Hybrid KEM fails on low-order points. ##### What's Changed - kem/hybrid: ensure X25519 hybrids fails with low order points by [@Lekensteyn](https://github.com/Lekensteyn) in cloudflare/circl#541 - .github: Use native ARM64 builders instead of QEMU by [@Lekensteyn](https://github.com/Lekensteyn) in cloudflare/circl#542 - Fixes several errors on twisted Edwards curves. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#545 - Release v1.6.1 by [@armfazh](https://github.com/armfazh) in cloudflare/circl#546 **Full Changelog**: cloudflare/circl@v1.6.0...v1.6.1 ### [`v1.6.0`](https://github.com/cloudflare/circl/releases/tag/v1.6.0): CIRCL v1.6.0 [Compare Source](cloudflare/circl@v1.5.0...v1.6.0) #### CIRCL v1.6.0 ##### New! - [Prio3](https://github.com/cloudflare/circl/blob/main/vdaf/prio3) Verifiable Distributed Aggregation Function ([draft-irtf-cfrg-vdaf](https://datatracker.ietf.org/doc/draft-irtf-cfrg-vdaf/)). - [X-Wing](https://github.com/cloudflare/circl/blob/main/kem/xwing): general-purpose hybrid post-quantum KEM ([draft-connolly-cfrg-xwing-kem](https://datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/)) ##### What's Changed - Add OIDs to ML-DSA by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#519 - Adds Prio3 a set of verifiable distributed aggregation functions. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#522 - Run semgrep cronjob only in upstream repository. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#526 - X-Wing PQ/T hybrid by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#471 - ckem: move crypto/elliptic to crypto/ecdh by [@MingLLuo](https://github.com/MingLLuo) in cloudflare/circl#529 - hpke: Update HPKE code to use ecdh stdlib package. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#530 - prio3: Adds polynomial multiplication using NTT by [@armfazh](https://github.com/armfazh) in cloudflare/circl#532 - Add Prio3 in readme. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#527 ##### New Contributors - [@MingLLuo](https://github.com/MingLLuo) made their first contribution in cloudflare/circl#529 **Full Changelog**: cloudflare/circl@v1.5.0...v1.6.0 ### [`v1.5.0`](https://github.com/cloudflare/circl/releases/tag/v1.5.0): CIRCL v1.5.0 [Compare Source](cloudflare/circl@v1.4.0...v1.5.0) ### CIRCL v1.5.0 **New:** ML-DSA, Module-Lattice-based Digital Signature Algorithm. ##### What's Changed - kem: add X25519MLKEM768 TLS hybrid KEM by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#510 - Create semgrep.yml by [@hrushikeshdeshpande](https://github.com/hrushikeshdeshpande) in cloudflare/circl#514 - repo: Some fixes reported by CodeQL by [@armfazh](https://github.com/armfazh) in cloudflare/circl#515 - Add ML-DSA (FIPS204) by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#480 - sign/mldsa: Add test for ML-DSA signature verification. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#517 - Release v1.5.0 by [@armfazh](https://github.com/armfazh) in cloudflare/circl#518 ##### New Contributors - [@hrushikeshdeshpande](https://github.com/hrushikeshdeshpande) made their first contribution in cloudflare/circl#514 **Full Changelog**: cloudflare/circl@v1.4.0...v1.5.0 ### [`v1.4.0`](https://github.com/cloudflare/circl/releases/tag/v1.4.0): CIRCL v1.4.0 [Compare Source](cloudflare/circl@v1.3.9...v1.4.0) ### CIRCL v1.4.0 ##### Changes New: ML-KEM compatible with FIPS-203. ##### Commit History - eddilithium3: fix typos by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#503 - Add ML-KEM (FIPS 203). by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#470 - Add ML-KEM decapsulation key check. by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#507 - Preparing for release v1.4.0 by [@armfazh](https://github.com/armfazh) in cloudflare/circl#508 **Full Changelog**: cloudflare/circl@v1.3.9...v1.4.0 ### [`v1.3.9`](https://github.com/cloudflare/circl/releases/tag/v1.3.9): CIRCL v1.3.9 [Compare Source](cloudflare/circl@v1.3.8...v1.3.9) #### CIRCL v1.3.9 ##### Changes: - Fix bug on BLS12381 decoding elements. ##### Commit History - dilithium: fix typo by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#498 - bls12381: Detects invalid prefix in G1 and G2 serialized elements by [@armfazh](https://github.com/armfazh) in cloudflare/circl#500 - Preparing CIRCL release v1.3.9 by [@armfazh](https://github.com/armfazh) in cloudflare/circl#501 **Full Changelog**: cloudflare/circl@v1.3.8...v1.3.9 ### [`v1.3.8`](https://github.com/cloudflare/circl/releases/tag/v1.3.8): CIRCL v1.3.8 [Compare Source](cloudflare/circl@v1.3.7...v1.3.8) ### CIRCL v1.3.8 #### New - BLS Signatures on top of BLS12-381. - Adopt faster squaring in pairings. - BlindRSA compliant with RFC9474. - (Verifiable) Secret Sharing compatible with the Group interface (elliptic curves). #### Notice - Update on cpabe/tkn20 ciphertexts, read more at https://github.com/cloudflare/circl/wiki/tkn20-Ciphertext-Format-(v1.3.8) ##### What's Changed - Implement Granger-Scott faster squaring in the cyclotomic subgroup. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#449 - Updates avo and CIRCL's own dependency. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#474 - Updating documentation for OPRF package. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#475 - group: removes order method from group interface by [@armfazh](https://github.com/armfazh) in cloudflare/circl#356 - zk/dleq: Adding DLEQ proofs for Qn, the subgroup of squares in (Z/nZ)\* by [@armfazh](https://github.com/armfazh) in cloudflare/circl#451 - Reduce x/crypto and x/sys versions to match Go 1.21 by [@Lekensteyn](https://github.com/Lekensteyn) in cloudflare/circl#476 - Bump GitHub Actions versions and use Go 1.22 and 1.21 by [@Lekensteyn](https://github.com/Lekensteyn) in cloudflare/circl#477 - Adding rule for constant values by [@armfazh](https://github.com/armfazh) in cloudflare/circl#478 - Add BLS signatures over BLS12-381 by [@armfazh](https://github.com/armfazh) in cloudflare/circl#446 - group: Implements Shamir and Feldman secret sharing. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#348 - blindrsa: add support for all variants of RFC9474 by [@armfazh](https://github.com/armfazh) in cloudflare/circl#479 - Explicitly installs Go with version before CodeQL analysis. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#481 - Bumps golangci-lint action by [@armfazh](https://github.com/armfazh) in cloudflare/circl#485 - ecc/bls12381: Ensures pairing operations don't overwrite their input by [@armfazh](https://github.com/armfazh) in cloudflare/circl#494 - Align to the `purego` build tag, removing `noasm` build tag by [@mattyclarkson](https://github.com/mattyclarkson) in cloudflare/circl#492 - cpabe: Serializing ciphertext with 32-bit prefixes. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#490 ##### New Contributors - [@mattyclarkson](https://github.com/mattyclarkson) made their first contribution in cloudflare/circl#492 **Full Changelog**: cloudflare/circl@v1.3.7...v1.3.8 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/605 Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org> Co-authored-by: Renovate Bot <bot@kriese.eu> Co-committed-by: Renovate Bot <bot@kriese.eu>

bwesterb marked this pull request as draft January 4, 2024 21:45

bwesterb changed the title ~~[WIP] Add ML-KEM (FIPS 203).~~ [DNM] Add ML-KEM (FIPS 203). Feb 15, 2024

bwesterb requested a review from armfazh February 15, 2024 13:22

Lekensteyn reviewed Feb 15, 2024

View reviewed changes

Lekensteyn approved these changes Feb 16, 2024

View reviewed changes

armfazh added the on-hold label Feb 17, 2024

bwesterb mentioned this pull request Apr 22, 2024

Unpacking Kyber keys from a FIPS 203 x509 key spec #496

Closed

armfazh reviewed Jul 5, 2024

View reviewed changes

bwesterb removed the on-hold label Aug 13, 2024

bwesterb self-assigned this Aug 13, 2024

bwesterb force-pushed the bas/ml-kem branch from dc69d32 to 02b92ba Compare August 13, 2024 10:46

bwesterb changed the title ~~[DNM] Add ML-KEM (FIPS 203).~~ Add ML-KEM (FIPS 203). Aug 13, 2024

bwesterb marked this pull request as ready for review August 13, 2024 10:48

bwesterb force-pushed the bas/ml-kem branch 3 times, most recently from 6d7c6f4 to 9095c87 Compare August 13, 2024 11:27

Lekensteyn reviewed Aug 13, 2024

View reviewed changes

bwesterb force-pushed the bas/ml-kem branch from 9095c87 to 7fe1dfc Compare August 13, 2024 16:19

armfazh reviewed Aug 13, 2024

View reviewed changes

Add ML-KEM (FIPS 203).

e85bad2

We keep Kyber around (for now) as it's currently widely deployed. Code differences between them are minimal anyway. Tests against NIST's ACVP test vectors.

bwesterb force-pushed the bas/ml-kem branch from 7fe1dfc to e85bad2 Compare August 15, 2024 18:54

armfazh approved these changes Aug 16, 2024

View reviewed changes

armfazh merged commit 2b4626d into main Aug 16, 2024
10 checks passed

armfazh deleted the bas/ml-kem branch August 16, 2024 09:24

red-hat-konflux bot mentioned this pull request Aug 7, 2025

fix(deps): update all non-major gomod dependencies app-sre/go-qontract-reconcile#124

Open

1 task

		@@ -143,6 +151,9 @@ func (pk *PublicKey) EncapsulateTo(ct, ss []byte, seed []byte) {
		// c = Kyber.CPAPKE.Enc(pk, m, r)
		pk.pk.EncryptTo(ct, m[:], kr[32:])

	pk.pk.EncryptTo(ct, m[:], kr[32:])
	pk.pk.EncryptTo(ct, m[:], kr[SharedKeySize:])

Add ML-KEM (FIPS 203). #470

Add ML-KEM (FIPS 203). #470

Uh oh!

Conversation

bwesterb commented Jan 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Lekensteyn left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bwesterb commented Feb 15, 2024

Uh oh!

mvd-ows commented Jul 4, 2024

Uh oh!

bwesterb commented Jul 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mvd-ows commented Jul 4, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bwesterb commented Jan 4, 2024 •

edited

Loading

bwesterb commented Jul 4, 2024 •

edited

Loading