-
Notifications
You must be signed in to change notification settings - Fork 32
ML-DSA keyGen reuses Shake256 output #321
Description
environment
Demo
testSessionId
500178
vsId
2254620
Algorithm registration
[
{
"algorithm": "ML-DSA",
"mode": "keyGen",
"revision": "FIPS204",
"parameterSets": [
"ML-DSA-44",
"ML-DSA-65",
"ML-DSA-87"
]
}
]
Endpoint in which the error is experienced
Demo
Expected behavior
Test Case 41 for ML-DSA-65 specifies a seed value of 9d20abd2a2d3b9313ee70aabb7c8bd80d262cedd6c8b5bfba0cbcae1cbd31d70 then byte order reversal of the bytes yields value to use of 701DD3CBE1CACBA0FB5B8B6CDDCE62D280BDC8B7AB0AE73E31B9D3A2D2AB209D.
However, running this test case I get the following differences in the generated private key value:
Got 0x08 instead of 0x51 at offset 1406
Got 0x18 instead of 0x35 at offset 1407
Got 0xC7 instead of 0x57 at offset 3609
Got 0xFE instead of 0x08 at offset 3611
Got 0x09 instead of 0x4A at offset 3612
Got 0xBC instead of 0xBB at offset 3613
Got 0xA6 instead of 0xB6 at offset 3614
The first two differences are in the 5th of the 6 128 byte vectors of s2:
513508820…185525282755135
Since this repeats the first 2 bytes of the vector, it looks like the output of the Shake256 digest is reused instead of getting the next N bytes.