Merge pull request #79 from itzmeanjan/bump-subtle-dep

Use constant-time operations using `subtle` itself

Author: itzmeanjan

.clang-tidy

@@ -26,6 +26,7 @@ Checks: '
   -modernize-use-trailing-return-type,
   -modernize-use-auto,
   -modernize-use-ranges,
+  -portability-avoid-pragma-once,
   -readability-magic-numbers
 '
 CheckOptions:

include/ml_kem/internals/k_pke.hpp

@@ -8,6 +8,7 @@
 #include "ml_kem/internals/utility/params.hpp"
 #include "ml_kem/internals/utility/utils.hpp"
 #include "sha3/sha3_512.hpp"
+#include "subtle.hpp"
 #include <algorithm>
 #include <array>
 #include <cstddef>
@@ -71,9 +72,9 @@ keygen(std::span<const uint8_t, 32> d,
   std::copy(rho.begin(), rho.end(), rho_in_pubkey.begin());
   ml_kem_utils::poly_vec_encode<k, 12>(s, seckey);
 
-  ml_kem_utils::secure_zeroize(g_out);
-  ml_kem_utils::secure_zeroize(s);
-  ml_kem_utils::secure_zeroize(e);
+  subtle::ct_zeroize(g_out_span);
+  subtle::ct_zeroize(std::span(s));
+  subtle::ct_zeroize(std::span(e));
 }
 
 // Given a *valid* K-PKE public key, 32 -bytes message ( to be encrypted ) and 32 -bytes random coin
@@ -102,7 +103,7 @@ encrypt(std::span<const uint8_t, ml_kem_utils::get_pke_public_key_len(k)> pubkey
   ml_kem_utils::poly_vec_encode<k, 12>(t_prime, encoded_tprime);
 
   using encoded_pkey_t = std::span<const uint8_t, encoded_t_prime_in_pubkey.size()>;
-  const auto are_equal = ml_kem_utils::ct_memcmp(encoded_pkey_t(encoded_t_prime_in_pubkey), encoded_pkey_t(encoded_tprime));
+  const auto are_equal = subtle::ct_memcmp<uint8_t, uint32_t>(encoded_pkey_t(encoded_t_prime_in_pubkey), encoded_pkey_t(encoded_tprime));
   if (are_equal == 0U) {
     // Got an invalid public key
     return false;
@@ -153,10 +154,10 @@ encrypt(std::span<const uint8_t, ml_kem_utils::get_pke_public_key_len(k)> pubkey
   ml_kem_utils::poly_compress<dv>(v);
   ml_kem_utils::encode<dv>(v, poly_v_in_ctxt);
 
-  ml_kem_utils::secure_zeroize(r);
-  ml_kem_utils::secure_zeroize(e1);
-  ml_kem_utils::secure_zeroize(e2);
-  ml_kem_utils::secure_zeroize(m);
+  subtle::ct_zeroize(std::span(r));
+  subtle::ct_zeroize(std::span(e1));
+  subtle::ct_zeroize(std::span(e2));
+  subtle::ct_zeroize(std::span(m));
 
   return true;
 }
@@ -199,7 +200,7 @@ decrypt(std::span<const uint8_t, ml_kem_utils::get_pke_secret_key_len(k)> seckey
   ml_kem_utils::poly_compress<1>(v);
   ml_kem_utils::encode<1>(v, ptxt);
 
-  ml_kem_utils::secure_zeroize(s_prime);
+  subtle::ct_zeroize(std::span(s_prime));
 }
 
 }

include/ml_kem/internals/ml_kem.hpp

@@ -5,6 +5,7 @@
 #include "sha3/sha3_256.hpp"
 #include "sha3/sha3_512.hpp"
 #include "sha3/shake256.hpp"
+#include "subtle.hpp"
 #include <algorithm>
 #include <array>
 #include <cstddef>
@@ -88,15 +89,15 @@ encapsulate(std::span<const uint8_t, 32> m,
   const auto has_mod_check_passed = k_pke::encrypt<k, eta1, eta2, du, dv>(pubkey, m, g_out_span1, cipher);
   if (!has_mod_check_passed) {
     // Got an invalid public key
-    ml_kem_utils::secure_zeroize(g_in);
-    ml_kem_utils::secure_zeroize(g_out);
+    subtle::ct_zeroize(g_in_span);
+    subtle::ct_zeroize(g_out_span);
     return has_mod_check_passed;
   }
 
   std::copy(g_out_span0.begin(), g_out_span0.end(), shared_secret.begin());
 
-  ml_kem_utils::secure_zeroize(g_in);
-  ml_kem_utils::secure_zeroize(g_out);
+  subtle::ct_zeroize(g_in_span);
+  subtle::ct_zeroize(g_out_span);
   return true;
 }
 
@@ -158,14 +159,14 @@ decapsulate(std::span<const uint8_t, ml_kem_utils::get_kem_secret_key_len(k)> se
   (void)k_pke::encrypt<k, eta1, eta2, du, dv>(pubkey, g_in_span0, g_out_span1, c_prime);
 
   // line 9-12 of algorithm 17, in constant-time
-  using kdf_t = std::span<const uint8_t, shared_secret.size()>;
-  const uint32_t cond = ml_kem_utils::ct_memcmp(cipher, std::span<const uint8_t, ctlen>(c_prime));
-  ml_kem_utils::ct_cond_memcpy(cond, shared_secret, kdf_t(g_out_span0), kdf_t(j_out));
-
-  ml_kem_utils::secure_zeroize(g_in);
-  ml_kem_utils::secure_zeroize(g_out);
-  ml_kem_utils::secure_zeroize(j_out);
-  ml_kem_utils::secure_zeroize(c_prime);
+  std::copy(j_out.begin(), j_out.end(), shared_secret.begin());
+  const uint32_t cond = subtle::ct_memcmp<uint8_t, uint32_t>(cipher, std::span<const uint8_t, ctlen>(c_prime));
+  subtle::ct_conditional_memcpy<uint32_t, uint8_t, 32>(cond, shared_secret, g_out_span0);
+
+  subtle::ct_zeroize(g_in_span);
+  subtle::ct_zeroize(g_out_span);
+  subtle::ct_zeroize(std::span(j_out));
+  subtle::ct_zeroize(std::span(c_prime));
 }
 
 }

include/ml_kem/internals/utility/utils.hpp

@@ -1,57 +1,9 @@
 #pragma once
 #include "ml_kem/internals/utility/force_inline.hpp"
-#include "subtle.hpp"
-#include <array>
 #include <cstddef>
-#include <cstdint>
-#include <span>
-#include <type_traits>
 
 namespace ml_kem_utils {
 
-// Securely zeroizes a std::array, preventing the compiler from optimizing away the operation.
-// At compile-time: a plain fill suffices -- there is no real memory to protect.
-// At runtime: the fill is followed by a compiler barrier (empty asm with "memory" clobber)
-// that forces the compiler to treat the array's memory as externally observable, preventing
-// dead store elimination. The barrier generates zero instructions.
-template<typename T, size_t N>
-forceinline constexpr void
-secure_zeroize(std::array<T, N>& arr)
-{
-  arr.fill(T{});
-  if (!std::is_constant_evaluated()) {
-    asm volatile("" : : "r"(arr.data()) : "memory"); // NOLINT(hicpp-no-assembler)
-  }
-}
-
-// Given two byte arrays of equal length, this routine can be used for comparing them in constant-time,
-// producing truth value (0xffffffff) in case of equality, otherwise it returns false value (0x00000000).
-template<size_t n>
-forceinline constexpr uint32_t
-ct_memcmp(std::span<const uint8_t, n> bytes0, std::span<const uint8_t, n> bytes1)
-{
-  uint32_t flag = -1U;
-  for (size_t i = 0; i < n; i++) {
-    flag &= subtle::ct_eq<uint8_t, uint32_t>(bytes0[i], bytes1[i]);
-  }
-
-  return flag;
-}
-
-// Given a branch value, taking either 0x00000000 (false value) or 0xffffffff (truth value), this routine can be used for conditionally
-// copying bytes from either `source0` byte array (in case branch holds truth value) or `source1` byte array (if branch holds false value)
-// to `sink` byte array, all in constant-time.
-//
-// In simple words, `sink = cond ? source0 ? source1`
-template<size_t n>
-forceinline constexpr void
-ct_cond_memcpy(const uint32_t cond, std::span<uint8_t, n> sink, std::span<const uint8_t, n> source0, std::span<const uint8_t, n> source1)
-{
-  for (size_t i = 0; i < n; i++) {
-    sink[i] = subtle::ct_select(cond, source0[i], source1[i]);
-  }
-}
-
 // Returns compile-time computable K-PKE public key byte length.
 forceinline constexpr size_t
 get_pke_public_key_len(const size_t k)