sign: Adding SLH-DSA signature by armfazh · Pull Request #512 · cloudflare/circl

armfazh · 2024-09-11T21:22:34Z

This implementation supports the twelve parameter sets approved at FIPS 205

Test vectors match the ones at ACVP-Server version 1.1.0.38. These test vectors target both internal and external functions.

Pure and Prehash-based signatures are supported.

Implementation makes a good effort to avoid heap allocations that usually add a significant overhead.

armfazh · 2024-09-11T23:51:49Z

there is a timeout happening on the ARM build because tests are running in parallel, but it doesn't seems to be related to a failure in the code.

rozbb

This looks great! Almost all my comments are nitpicky bc I didn't have anything else to talk about :)

sign/slhdsa/wotsp.go

sign/slhdsa/wotsp_test.go

rozbb · 2024-09-19T20:43:25Z

sign/slhdsa/xmss.go

+}
+
+// See FIPS 205 -- Section 6.1 -- Algorithm 9 -- Iterative version.
+func (s *statePriv) xmssNodeIter(


Similar thing. I had trouble following along with this algorithm, since it differs so much from the paper. Also why is i a parameter at all if it's not a recursive algorithm?

Internally, the index of each node is used as part of the hash parameters. So, i denotes the first index of a sub-tree.

sign/slhdsa/xmss.go

rozbb · 2024-09-23T17:05:08Z

sign/slhdsa/internal.go

+	defer s.Clear()
+
+	s.forsSign(sig.forsSig, md, addr)
+	pkFors := s.forsPkFromSig(md, sig.forsSig, addr)


Would it be possible to compute pkFors as a side effect of forsSign? Can save a few hashes if so. Similarly might be able to do this in the htSign function

I've tried to coalesce these functions, but didn't found any savings on the number of hashes.

armfazh · 2024-11-13T22:13:14Z

ACVP test vectors updated to v1.1.0.37

sign/schemes/schemes.go

sign/slhdsa/acvp_test.go

bwesterb · 2024-12-09T13:16:14Z

sign/slhdsa/address.go

+	addressSizeNonCompressed = 32
+)
+
+type address struct {


Might be more efficient with respect to allocations to use [32]byte as address type.

I tried that but didn't see any postive effect on allocs.

sign/slhdsa/hypertree.go

sign/slhdsa/message.go

Passes Test vectors from ACVP for internal functions.

quantumcoinproject · 2025-06-06T03:25:52Z

Hi, thanks for adding support for SLH-DSA. Is there anything else that needs to happen before this can be merged?

Today, we are using liboqs bindings today in our GO code, but prefer GO direct implementation over native code (in C) to de-risk any unexpected memory issues. From GO dev group, the support for ML-DSA and SLH-DSA is not planned anytime soon (none this year), hence we are looking for alternate options to improve memory safety.

quantumcoinproject · 2025-06-06T17:06:47Z

Thanks for merging!

…1418) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/cloudflare/circl](https://github.com/cloudflare/circl) | `v1.6.1` -> `v1.6.3` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fcloudflare%2fcircl/v1.6.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fcloudflare%2fcircl/v1.6.1/v1.6.3?slim=true) | --- ### CIRCL has an incorrect calculation in secp384r1 CombinedMult [CVE-2026-1229](https://nvd.nist.gov/vuln/detail/CVE-2026-1229) / [GHSA-q9hv-hpm4-hj6x](GHSA-q9hv-hpm4-hj6x) <details> <summary>More information</summary> #### Details The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed in **[v1.6.3](https://github.com/cloudflare/circl/releases/tag/v1.6.3)**. #### Severity - CVSS Score: 2.9 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/U:Amber` #### References - [https://github.com/cloudflare/circl/security/advisories/GHSA-q9hv-hpm4-hj6x](https://github.com/cloudflare/circl/security/advisories/GHSA-q9hv-hpm4-hj6x) - [https://nvd.nist.gov/vuln/detail/CVE-2026-1229](https://nvd.nist.gov/vuln/detail/CVE-2026-1229) - [https://github.com/cloudflare/circl/pull/583](https://github.com/cloudflare/circl/pull/583) - [https://github.com/cloudflare/circl](https://github.com/cloudflare/circl) - [https://github.com/cloudflare/circl/releases/tag/v1.6.3](https://github.com/cloudflare/circl/releases/tag/v1.6.3) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-q9hv-hpm4-hj6x) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>cloudflare/circl (github.com/cloudflare/circl)</summary> ### [`v1.6.3`](https://github.com/cloudflare/circl/releases/tag/v1.6.3): CIRCL v1.6.3 [Compare Source](cloudflare/circl@v1.6.2...v1.6.3) #### CIRCL v1.6.3 Fix a bug on ecc/p384 scalar multiplication. ##### What's Changed - sign/mldsa: Check opts for nil value by [@armfazh](https://github.com/armfazh) in [#582](cloudflare/circl#582) - ecc/p384: Point addition must handle point doubling case. by [@armfazh](https://github.com/armfazh) in [#583](cloudflare/circl#583) - Release CIRCL v1.6.3 by [@armfazh](https://github.com/armfazh) in [#584](cloudflare/circl#584) **Full Changelog**: <cloudflare/circl@v1.6.2...v1.6.3> ### [`v1.6.2`](https://github.com/cloudflare/circl/releases/tag/v1.6.2): CIRCL v1.6.2 [Compare Source](cloudflare/circl@v1.6.1...v1.6.2) #### CIRCL v1.6.2 - New SLH-DSA, improvements in ML-DSA for arm64. - Tested compilation on WASM. #### What's Changed - Optimize pairing product computation by moving exponentiations to G1. by [@dfaranha](https://github.com/dfaranha) in [#547](cloudflare/circl#547) - sign: Adding SLH-DSA signature by [@armfazh](https://github.com/armfazh) in [#512](cloudflare/circl#512) - Update code generators to CIRCL v1.6.1. by [@armfazh](https://github.com/armfazh) in [#548](cloudflare/circl#548) - ML-DSA: Add preliminary Wycheproof test vectors by [@bwesterb](https://github.com/bwesterb) in [#552](cloudflare/circl#552) - go fmt by [@bwesterb](https://github.com/bwesterb) in [#554](cloudflare/circl#554) - gz-compressing test vectors, use of HexBytes and ReadGzip functions. by [@armfazh](https://github.com/armfazh) in [#555](cloudflare/circl#555) - group: Removes use of elliptic Marshal and Unmarshal functions. by [@armfazh](https://github.com/armfazh) in [#556](cloudflare/circl#556) - Support encoding/decoding ML-DSA private keys (as long as they contain seeds) by [@bwesterb](https://github.com/bwesterb) in [#559](cloudflare/circl#559) - Update to golangci-lint v2 by [@bwesterb](https://github.com/bwesterb) in [#560](cloudflare/circl#560) - Preparation for ARM64 Implementation of poly operations for dilithium package. by [@elementrics](https://github.com/elementrics) in [#562](cloudflare/circl#562) - prepare power2Round for custom implementations in assembly by [@elementrics](https://github.com/elementrics) in [#564](cloudflare/circl#564) - ARM64 implementation for poly.PackLe16 by [@elementrics](https://github.com/elementrics) in [#563](cloudflare/circl#563) - add arm64 version of polyMulBy2toD by [@elementrics](https://github.com/elementrics) in [#565](cloudflare/circl#565) - add arm64 version of polySub by [@elementrics](https://github.com/elementrics) in [#566](cloudflare/circl#566) - group: add byteLen method for short groups and RandomScalar uses rand.Int by [@armfazh](https://github.com/armfazh) in [#568](cloudflare/circl#568) - add arm64 version of poly.Add/Sub by [@elementrics](https://github.com/elementrics) in [#572](cloudflare/circl#572) - group: Adding cryptobyte marshaling to scalars by [@armfazh](https://github.com/armfazh) in [#569](cloudflare/circl#569) - Bumping up to Go1.25 by [@armfazh](https://github.com/armfazh) in [#574](cloudflare/circl#574) - ci: Including WASM compilation. by [@armfazh](https://github.com/armfazh) in [#577](cloudflare/circl#577) - Revert to using package-declared HPKE errors for shortkem instead of standard library errors by [@harshiniwho](https://github.com/harshiniwho) in [#578](cloudflare/circl#578) - Release v1.6.2 by [@armfazh](https://github.com/armfazh) in [#579](cloudflare/circl#579) #### New Contributors - [@dfaranha](https://github.com/dfaranha) made their first contribution in [#547](cloudflare/circl#547) - [@elementrics](https://github.com/elementrics) made their first contribution in [#562](cloudflare/circl#562) - [@harshiniwho](https://github.com/harshiniwho) made their first contribution in [#578](cloudflare/circl#578) **Full Changelog**: <cloudflare/circl@v1.6.1...v1.6.2> </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1418 Reviewed-by: Michael Kriese <michael.kriese@gmx.de> Co-authored-by: Renovate Bot <bot@kriese.eu> Co-committed-by: Renovate Bot <bot@kriese.eu>

armfazh added the on-hold label Sep 11, 2024

armfazh requested review from bwesterb, cjpatton and lukevalenta September 11, 2024 21:22

armfazh self-assigned this Sep 11, 2024

rozbb reviewed Sep 23, 2024

View reviewed changes

armfazh force-pushed the adding_slhdsa branch 3 times, most recently from 12020e3 to 32046e4 Compare October 10, 2024 10:07

armfazh force-pushed the adding_slhdsa branch from 32046e4 to c74a2d3 Compare October 16, 2024 22:25

bwesterb reviewed Dec 9, 2024

View reviewed changes

sign/schemes/schemes.go Outdated Show resolved Hide resolved

bwesterb reviewed Dec 9, 2024

View reviewed changes

sign/slhdsa/acvp_test.go Show resolved Hide resolved

bwesterb reviewed Dec 9, 2024

View reviewed changes

sign/slhdsa/hypertree.go Outdated Show resolved Hide resolved

bwesterb reviewed Dec 9, 2024

View reviewed changes

sign/slhdsa/message.go Outdated Show resolved Hide resolved

bwesterb self-requested a review December 9, 2024 13:29

bwesterb approved these changes Dec 9, 2024

View reviewed changes

armfazh added 11 commits February 2, 2025 03:27

Adding helpers for cryptobyte marshalling.

2549280

Adding Stateless Hash-based Digital Signature Algorithm (SLH-DSA)

5dcd807

Passes Test vectors from ACVP for internal functions.

Integrate SLH-DSA in the list of signature schemes.

0bde785

Changes after rozbb review.

681cc9f

Convert to a long test.

7d183b3

Adding OID from NIST for Pure signing schemes.

509cb55

Updating ACVP test vectors to v1.1.0.37

7ff0831

Building scheme interface.

c328f7f

Refactoring PreHashing.

84db9ae

Refactor on message and prehashing.

20a937f

Updating ACVP test vectors to v1.1.0.38

5766545

armfazh added 3 commits February 2, 2025 03:27

Few more refactors and field alignment.

07d20e3

Skip ACVP tests on small and internal interface.

bdfc092

Refactor name of algorithm identifiers.

5e2385c

armfazh force-pushed the adding_slhdsa branch from a91ad61 to 5e2385c Compare February 2, 2025 11:57

armfazh mentioned this pull request Feb 2, 2025

pq: unify the ACVP code for testing #533

Open

armfazh added new feature New functionality or module and removed on-hold labels Feb 2, 2025

armfazh requested a review from bwesterb February 2, 2025 12:18

bwesterb approved these changes Feb 21, 2025

View reviewed changes

armfazh merged commit 3fcf21b into cloudflare:main Jun 6, 2025
10 checks passed

Conversation

armfazh commented Sep 11, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

armfazh commented Sep 11, 2024

Uh oh!

rozbb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rozbb Sep 19, 2024

Choose a reason for hiding this comment

Uh oh!

armfazh Oct 9, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rozbb Sep 23, 2024

Choose a reason for hiding this comment

Uh oh!

armfazh Oct 9, 2024

Choose a reason for hiding this comment

Uh oh!

armfazh commented Nov 13, 2024

Uh oh!

Uh oh!

Uh oh!

bwesterb Dec 9, 2024

Choose a reason for hiding this comment

Uh oh!

armfazh Feb 2, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

quantumcoinproject commented Jun 6, 2025

Uh oh!

Uh oh!

quantumcoinproject commented Jun 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

armfazh commented Sep 11, 2024 •

edited

Loading