Add ML-DSA (FIPS204) #480

bwesterb · 2024-02-15T12:54:44Z

Note There are no complete test vectors for FIPS 204 yet. I propose we'll wait for that before we merge this. (The ACVP test vectors only test ML-DSA.Sign_internal.)

Adds ML-DSA aka FIPS 204.

Tests against reference implementation and ACVP test vectors.

Keeps old Dilithium around in case it's used, but removes the AES modes.

Hooks Dilithium and ML-DSA into the generic signatures API. Removes the old Dilithium mode API.

Adds support for the ML-DSA randomised variant, but only via the package API — not generic signature API.

Does not add support for the HashML-DSA variants.

sign/dilithium/mldsa65.go

armfazh

Just minor changes. Overall is ok.

Q: is this compliant with ACVP test files?

https://github.com/usnistgov/ACVP-Server/tree/master/gen-val/json-files/ML-DSA-sigGen-FIPS204

armfazh · 2024-10-04T20:34:10Z

sign/dilithium/templates/pkg.templ.go

-	SignTo(sk, msg, sig[:])
-	return sig[:], nil
+	{{- if .NIST }}
+	if err = SignTo(sk, msg, nil, false, ret[:]); err != nil {


here we are defaulting Sign to be a deterministic algorithm,
From Sec 3.4:

Only implementing the hedged variant (i.e., without the deterministic variant) is sufficient to guarantee interoperability.

It seems to me that the default should be randomized signatures.
Note that Sign receives a 'rand io.Reader' variable for providing randomness to the function.

From the Dilithium specification:

Randomised signing is easier to make side channel secure against power/EM leakage in hardware. Thus it makes sense to use it as default in hardware. In software deterministic signing as default seems to make more sense. I don't think it makes a big difference. A non security argument is that the deterministic variant is easier to test.

sign/dilithium/templates/pkg.templ.go

sign/internal/dilithium/aes.go

sign/dilithium/dilithium.go

sign/dilithium/mode3/internal/dilithium.go

sign/schemes/schemes.go

armfazh · 2024-10-04T21:59:29Z

sign/schemes/schemes.go

@@ -16,13 +16,27 @@ import (
 	"github.com/cloudflare/circl/sign/ed448"
 	"github.com/cloudflare/circl/sign/eddilithium2"
 	"github.com/cloudflare/circl/sign/eddilithium3"
+
+	dilithium2 "github.com/cloudflare/circl/sign/dilithium/mode2"


In the past, we've recommend not to use dilithium alone, but used as a hybrid.
Has something changed?

For the web, PQ certificates only add value once a CRQC is close. Once that happens, hybrids don't make sense anymore. Also, the standardisation of hybrids for signatures is quite messy.

bwesterb · 2024-10-08T12:55:41Z

Q: is this compliant with ACVP test files?

Forgot to add tests. Done now. Should be good to merge (and squash.)

The final version of FIPS204 has not been released, thus this implementation is not yet final.

@wussler

Thanks-to: @wussler

Remove old mode API and hook Dilithium and ML-DSA into generic signature API. Expose support for randomized ML-DSA mode. (It is not exposed in the generic signature API.) Remove old AES variants of Dilithium. Does not add the HashML-DSA variants (yet).

Fix one bug in key derivation.

bwesterb · 2024-10-08T16:16:02Z

Rebased.

…605) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/cloudflare/circl](https://github.com/cloudflare/circl) | indirect | minor | `v1.3.7` -> `v1.6.1` | --- ### CIRCL-Fourq: Missing and wrong validation can lead to incorrect results [GHSA-2x5j-vhc8-9cwm](GHSA-2x5j-vhc8-9cwm) / [GO-2025-3754](https://pkg.go.dev/vuln/GO-2025-3754) <details> <summary>More information</summary> #### Details ##### Impact The CIRCL implementation of FourQ fails to validate user-supplied low-order points during Diffie-Hellman key exchange, potentially allowing attackers to force the identity point and compromise session security. Moreover, there is an incorrect point validation in ScalarMult can lead to incorrect results in the isEqual function and if a point is on the curve. ##### Patches Version 1.6.1 (https://github.com/cloudflare/circl/tree/v1.6.1) mitigates the identified issues. We acknowledge Alon Livne (Botanica Software Labs) for the reported findings. #### Severity Low #### References - [https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm](https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm) - [https://github.com/cloudflare/circl](https://github.com/cloudflare/circl) - [https://github.com/cloudflare/circl/tree/v1.6.1](https://github.com/cloudflare/circl/tree/v1.6.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-2x5j-vhc8-9cwm) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl [GHSA-2x5j-vhc8-9cwm](GHSA-2x5j-vhc8-9cwm) / [GO-2025-3754](https://pkg.go.dev/vuln/GO-2025-3754) <details> <summary>More information</summary> #### Details CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl #### Severity Unknown #### References - [https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm](https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm) - [https://github.com/cloudflare/circl/tree/v1.6.1](https://github.com/cloudflare/circl/tree/v1.6.1) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2025-3754) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>cloudflare/circl (github.com/cloudflare/circl)</summary> ### [`v1.6.1`](https://github.com/cloudflare/circl/releases/tag/v1.6.1): CIRCL v1.6.1 [Compare Source](cloudflare/circl@v1.6.0...v1.6.1) #### CIRCL v1.6.1 - Fixes some point checks on the FourQ curve. - Hybrid KEM fails on low-order points. ##### What's Changed - kem/hybrid: ensure X25519 hybrids fails with low order points by [@Lekensteyn](https://github.com/Lekensteyn) in cloudflare/circl#541 - .github: Use native ARM64 builders instead of QEMU by [@Lekensteyn](https://github.com/Lekensteyn) in cloudflare/circl#542 - Fixes several errors on twisted Edwards curves. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#545 - Release v1.6.1 by [@armfazh](https://github.com/armfazh) in cloudflare/circl#546 **Full Changelog**: cloudflare/circl@v1.6.0...v1.6.1 ### [`v1.6.0`](https://github.com/cloudflare/circl/releases/tag/v1.6.0): CIRCL v1.6.0 [Compare Source](cloudflare/circl@v1.5.0...v1.6.0) #### CIRCL v1.6.0 ##### New! - [Prio3](https://github.com/cloudflare/circl/blob/main/vdaf/prio3) Verifiable Distributed Aggregation Function ([draft-irtf-cfrg-vdaf](https://datatracker.ietf.org/doc/draft-irtf-cfrg-vdaf/)). - [X-Wing](https://github.com/cloudflare/circl/blob/main/kem/xwing): general-purpose hybrid post-quantum KEM ([draft-connolly-cfrg-xwing-kem](https://datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/)) ##### What's Changed - Add OIDs to ML-DSA by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#519 - Adds Prio3 a set of verifiable distributed aggregation functions. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#522 - Run semgrep cronjob only in upstream repository. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#526 - X-Wing PQ/T hybrid by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#471 - ckem: move crypto/elliptic to crypto/ecdh by [@MingLLuo](https://github.com/MingLLuo) in cloudflare/circl#529 - hpke: Update HPKE code to use ecdh stdlib package. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#530 - prio3: Adds polynomial multiplication using NTT by [@armfazh](https://github.com/armfazh) in cloudflare/circl#532 - Add Prio3 in readme. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#527 ##### New Contributors - [@MingLLuo](https://github.com/MingLLuo) made their first contribution in cloudflare/circl#529 **Full Changelog**: cloudflare/circl@v1.5.0...v1.6.0 ### [`v1.5.0`](https://github.com/cloudflare/circl/releases/tag/v1.5.0): CIRCL v1.5.0 [Compare Source](cloudflare/circl@v1.4.0...v1.5.0) ### CIRCL v1.5.0 **New:** ML-DSA, Module-Lattice-based Digital Signature Algorithm. ##### What's Changed - kem: add X25519MLKEM768 TLS hybrid KEM by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#510 - Create semgrep.yml by [@hrushikeshdeshpande](https://github.com/hrushikeshdeshpande) in cloudflare/circl#514 - repo: Some fixes reported by CodeQL by [@armfazh](https://github.com/armfazh) in cloudflare/circl#515 - Add ML-DSA (FIPS204) by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#480 - sign/mldsa: Add test for ML-DSA signature verification. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#517 - Release v1.5.0 by [@armfazh](https://github.com/armfazh) in cloudflare/circl#518 ##### New Contributors - [@hrushikeshdeshpande](https://github.com/hrushikeshdeshpande) made their first contribution in cloudflare/circl#514 **Full Changelog**: cloudflare/circl@v1.4.0...v1.5.0 ### [`v1.4.0`](https://github.com/cloudflare/circl/releases/tag/v1.4.0): CIRCL v1.4.0 [Compare Source](cloudflare/circl@v1.3.9...v1.4.0) ### CIRCL v1.4.0 ##### Changes New: ML-KEM compatible with FIPS-203. ##### Commit History - eddilithium3: fix typos by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#503 - Add ML-KEM (FIPS 203). by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#470 - Add ML-KEM decapsulation key check. by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#507 - Preparing for release v1.4.0 by [@armfazh](https://github.com/armfazh) in cloudflare/circl#508 **Full Changelog**: cloudflare/circl@v1.3.9...v1.4.0 ### [`v1.3.9`](https://github.com/cloudflare/circl/releases/tag/v1.3.9): CIRCL v1.3.9 [Compare Source](cloudflare/circl@v1.3.8...v1.3.9) #### CIRCL v1.3.9 ##### Changes: - Fix bug on BLS12381 decoding elements. ##### Commit History - dilithium: fix typo by [@bwesterb](https://github.com/bwesterb) in cloudflare/circl#498 - bls12381: Detects invalid prefix in G1 and G2 serialized elements by [@armfazh](https://github.com/armfazh) in cloudflare/circl#500 - Preparing CIRCL release v1.3.9 by [@armfazh](https://github.com/armfazh) in cloudflare/circl#501 **Full Changelog**: cloudflare/circl@v1.3.8...v1.3.9 ### [`v1.3.8`](https://github.com/cloudflare/circl/releases/tag/v1.3.8): CIRCL v1.3.8 [Compare Source](cloudflare/circl@v1.3.7...v1.3.8) ### CIRCL v1.3.8 #### New - BLS Signatures on top of BLS12-381. - Adopt faster squaring in pairings. - BlindRSA compliant with RFC9474. - (Verifiable) Secret Sharing compatible with the Group interface (elliptic curves). #### Notice - Update on cpabe/tkn20 ciphertexts, read more at https://github.com/cloudflare/circl/wiki/tkn20-Ciphertext-Format-(v1.3.8) ##### What's Changed - Implement Granger-Scott faster squaring in the cyclotomic subgroup. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#449 - Updates avo and CIRCL's own dependency. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#474 - Updating documentation for OPRF package. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#475 - group: removes order method from group interface by [@armfazh](https://github.com/armfazh) in cloudflare/circl#356 - zk/dleq: Adding DLEQ proofs for Qn, the subgroup of squares in (Z/nZ)\* by [@armfazh](https://github.com/armfazh) in cloudflare/circl#451 - Reduce x/crypto and x/sys versions to match Go 1.21 by [@Lekensteyn](https://github.com/Lekensteyn) in cloudflare/circl#476 - Bump GitHub Actions versions and use Go 1.22 and 1.21 by [@Lekensteyn](https://github.com/Lekensteyn) in cloudflare/circl#477 - Adding rule for constant values by [@armfazh](https://github.com/armfazh) in cloudflare/circl#478 - Add BLS signatures over BLS12-381 by [@armfazh](https://github.com/armfazh) in cloudflare/circl#446 - group: Implements Shamir and Feldman secret sharing. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#348 - blindrsa: add support for all variants of RFC9474 by [@armfazh](https://github.com/armfazh) in cloudflare/circl#479 - Explicitly installs Go with version before CodeQL analysis. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#481 - Bumps golangci-lint action by [@armfazh](https://github.com/armfazh) in cloudflare/circl#485 - ecc/bls12381: Ensures pairing operations don't overwrite their input by [@armfazh](https://github.com/armfazh) in cloudflare/circl#494 - Align to the `purego` build tag, removing `noasm` build tag by [@mattyclarkson](https://github.com/mattyclarkson) in cloudflare/circl#492 - cpabe: Serializing ciphertext with 32-bit prefixes. by [@armfazh](https://github.com/armfazh) in cloudflare/circl#490 ##### New Contributors - [@mattyclarkson](https://github.com/mattyclarkson) made their first contribution in cloudflare/circl#492 **Full Changelog**: cloudflare/circl@v1.3.7...v1.3.8 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/605 Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org> Co-authored-by: Renovate Bot <bot@kriese.eu> Co-committed-by: Renovate Bot <bot@kriese.eu>

bwesterb force-pushed the bas/ml-dsa branch 4 times, most recently from 9537079 to 5bd6e0d Compare February 15, 2024 13:06

bwesterb changed the title ~~[WIP] Add ML-DSA (FIPS204)~~ [DNM] Add ML-DSA (FIPS204) Feb 15, 2024

bwesterb marked this pull request as draft February 15, 2024 13:08

bwesterb force-pushed the bas/ml-dsa branch 2 times, most recently from e60db3b to 47bb92a Compare February 15, 2024 13:14

bwesterb requested a review from armfazh February 15, 2024 13:22

armfazh added the on-hold label Feb 17, 2024

wussler reviewed Feb 28, 2024

View reviewed changes

sign/dilithium/mldsa65.go Outdated Show resolved Hide resolved

bwesterb changed the title ~~[DNM] Add ML-DSA (FIPS204)~~ Add ML-DSA (FIPS204) Aug 20, 2024

bwesterb force-pushed the bas/ml-dsa branch from c0f5946 to 91c162a Compare August 20, 2024 13:41

bwesterb marked this pull request as ready for review August 20, 2024 13:42

bwesterb force-pushed the bas/ml-dsa branch from 91c162a to 16210ac Compare August 20, 2024 13:46

bwesterb removed the on-hold label Aug 20, 2024

bwesterb self-assigned this Aug 20, 2024

bwesterb force-pushed the bas/ml-dsa branch from 16210ac to 1fbec7a Compare August 20, 2024 13:52

armfazh added the on-hold label Sep 11, 2024

bwesterb force-pushed the bas/ml-dsa branch from 1fbec7a to 7970d07 Compare September 25, 2024 09:59

bwesterb removed the on-hold label Sep 25, 2024

bwesterb force-pushed the bas/ml-dsa branch from 7970d07 to 16fa7b7 Compare September 25, 2024 10:03

armfazh requested changes Oct 4, 2024

View reviewed changes

bwesterb force-pushed the bas/ml-dsa branch from 16fa7b7 to 11ac58e Compare October 8, 2024 12:43

bwesterb and others added 5 commits October 8, 2024 18:15

[WIP] Add ML-DSA (FIPS204)

62302ce

The final version of FIPS204 has not been released, thus this implementation is not yet final.

dilithium: fix typo in privkey size panic

bf96f6e

Thanks-to: @wussler

ML-DSA test against reference implementation.

ecf1196

Fix one bug in key derivation.

dilithium: remove unused AES code

63eb44c

bwesterb added 4 commits October 8, 2024 18:15

mldsa: add ACVP test vectors

f1674c7

Remove superfluous space

a43f90b

Update ml-dsa documentation

0169792

Remove dead code

bef2502

bwesterb force-pushed the bas/ml-dsa branch from 66fc97f to bef2502 Compare October 8, 2024 16:15

armfazh added 2 commits October 8, 2024 18:06

Avoid to export unsafeSignInternal.

d55a0aa

Update command for golangci-lint.

dcffd66

armfazh approved these changes Oct 9, 2024

View reviewed changes

armfazh merged commit e2bbd01 into main Oct 9, 2024
10 checks passed

armfazh deleted the bas/ml-dsa branch October 9, 2024 03:07

armfazh mentioned this pull request Oct 9, 2024

ML-DSA? #473

Closed

UladzimirTrehubenka mentioned this pull request Oct 9, 2024

ACVP test "sigVer" is not used in #480 #516

Closed

red-hat-konflux bot mentioned this pull request Jul 24, 2025

fix(deps): update all non-major gomod dependencies app-sre/go-qontract-reconcile#124

Open

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add ML-DSA (FIPS204) #480

Add ML-DSA (FIPS204) #480

Uh oh!

bwesterb commented Feb 15, 2024 •

edited

Loading

Uh oh!

Uh oh!

armfazh left a comment

Uh oh!

armfazh Oct 4, 2024

Uh oh!

bwesterb Oct 8, 2024 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

armfazh Oct 4, 2024

Uh oh!

bwesterb Oct 8, 2024

Uh oh!

bwesterb commented Oct 8, 2024

Uh oh!

bwesterb commented Oct 8, 2024

Uh oh!

Uh oh!

Uh oh!

Add ML-DSA (FIPS204) #480

Add ML-DSA (FIPS204) #480

Uh oh!

Conversation

bwesterb commented Feb 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

armfazh left a comment

Choose a reason for hiding this comment

Uh oh!

armfazh Oct 4, 2024

Choose a reason for hiding this comment

Uh oh!

bwesterb Oct 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

armfazh Oct 4, 2024

Choose a reason for hiding this comment

Uh oh!

bwesterb Oct 8, 2024

Choose a reason for hiding this comment

Uh oh!

bwesterb commented Oct 8, 2024

Uh oh!

bwesterb commented Oct 8, 2024

Uh oh!

Uh oh!

Uh oh!

bwesterb commented Feb 15, 2024 •

edited

Loading

bwesterb Oct 8, 2024 •

edited

Loading