-
Notifications
You must be signed in to change notification settings - Fork 39
Make poly_chknorm constant flow #153
Copy link
Copy link
Closed
Labels
Description
The current implementation of poly_chknorm,
for (i = 0; i < MLDSA_N; ++i)
{
/* Absolute value */
t = a->coeffs[i] >> 31;
t = a->coeffs[i] - (t & 2 * a->coeffs[i]);
if (t >= B)
{
return 1;
}
}aborts upon the first entry which exceeds the given norm.
While there is a comment indicating why this does not leak anything sensitive, the input data is sensitive (from what I understand), so it seems safer to use a constant-flow implementation here.
Reactions are currently unavailable