authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2025-12-09 16:28:14+01:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2025-12-09 16:28:14+01:00
logd27c804d9fb3df640cd1e197d12a98aa31550b93
treeb4caf97235b36467a2cb75c338f6422d772ef132
parent60a9a7e0850b0c08e4a28f9edbcd942dcc2775e3
parenta0e9130b894f6eeb810f5ad25ff34fe9782b24ba

Merge pull request 'crypto.mlkem: return J(z||c) on implicit rejection' (#30155) from jedisct1/zig:mlkemrej into master

Reviewed-on: https://codeberg.org/ziglang/zig/pulls/30155

1 files changed, 9 insertions(+), 7 deletions(-)

lib/std/crypto/ml_kem.zig+9-7
......@@ -329,17 +329,19 @@ fn Kyber(comptime p: Params) type {
329329 // ct' = innerEnc(pk, m', r')
330330 const ct2 = sk.pk.encrypt(&m2, kr2[32..64]);
331331
332 // Compute H(ct) and put in the second slot of kr2 which will be (K'', H(ct)).
333 sha3.Sha3_256.hash(ct, kr2[32..], .{});
334
335 // Replace K'' by z in the first slot of kr2 if ct ≠ ct'.
336 cmov(32, kr2[0..32], sk.z, ctneq(ciphertext_length, ct.*, ct2));
337
338332 if (p.ml_kem) {
339 // ML-KEM: K = K''/z
333 // ML-KEM: K = K'' if ct == ct', else K = J(z || c) per FIPS 203
334 var k_bar: [shared_length]u8 = undefined;
335 var j = sha3.Shake256.init(.{});
336 j.update(&sk.z);
337 j.update(ct);
338 j.squeeze(&k_bar);
339 cmov(shared_length, kr2[0..shared_length], k_bar, ctneq(ciphertext_length, ct.*, ct2));
340340 return kr2[0..shared_length].*;
341341 } else {
342342 // Kyber: K = KDF(K''/z ‖ H(c))
343 sha3.Sha3_256.hash(ct, kr2[32..], .{});
344 cmov(32, kr2[0..32], sk.z, ctneq(ciphertext_length, ct.*, ct2));
343345 var ss: [shared_length]u8 = undefined;
344346 sha3.Shake256.hash(&kr2, &ss, .{});
345347 return ss;