ML-DSA test against reference implementation.

Fix one bug in key derivation.
cloudflare · armfazh · Oct 9, 2024 · Feb 15, 2024 · Feb 28, 2024 · Aug 20, 2024
commit ecf119605ff28587f34d5fffd7e0a9ab8906b6be
diff --git a/sign/dilithium/kat_test.go b/sign/dilithium/kat_test.go
@@ -24,14 +24,13 @@ func TestPQCgenKATSign(t *testing.T) {
 		{"Dilithium3", "8196b32212753f525346201ffec1c7a0a852596fa0b57bd4e2746231dab44d55"},
 		{"Dilithium5", "7ded97a6e6c809b43b54c248171d7504fa6a0cab651bf288bb00034782667481"},
 
-		// TODO Update to final FIPS 204 standard. Test vectors below are for the IPD.
-		//
-		// Generated from reference implementation commit e7bed6258b9a3703ce78d4ec3,
-		// which can be found on the standard branch
-		// of https://github.com/pq-crystals/dilithium
-		// {"ML-DSA-44", "4657f244d1204e5847b3cacea4fc6116579571bee8ac89b8cba6771f303ee260"},
-		// {"ML-DSA-65", "99a95d7ef804020a666f455c5003232d0c0200dfc4f5df85dceb8f56256dcba8"},
-		// {"ML-DSA-87", "3377835fffb7cf9aac52947225c8974335bc05532ddf672a8b706ab8991435a2"},
+		// Generated from reference implementation commit cbcd8753a43402885c90343c
+		// which can be found at https://github.com/pq-crystals/dilithium
+		// with the DILITHIUM_RANDOMIZED_SIGNING macro unset in ref/config.h
+		// to disable randomized signing.
+		{"ML-DSA-44", "14f92c48abc0d63ea263cce3c83183c8360c6ede7cbd5b65bd7c6f31e38f0ea5"},
+		{"ML-DSA-65", "595a8eff6988159c94eb5398294458c5d27d21c994fb64cadbee339173abcf63"},
+		{"ML-DSA-87", "35e2ce3d88b3311517bf8d41aa2cd24aa0fbda2bb8052ca8af4ad8d7c7344074"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			mode := schemes.ByName(tc.name)

diff --git a/sign/dilithium/mode2/internal/dilithium.go b/sign/dilithium/mode2/internal/dilithium.go
diff --git a/sign/dilithium/mode3/internal/dilithium.go b/sign/dilithium/mode3/internal/dilithium.go
@@ -178,6 +178,11 @@ func NewKeyFromSeed(seed *[common.SeedSize]byte) (*PublicKey, *PrivateKey) {
 
 	h := sha3.NewShake256()
 	_, _ = h.Write(seed[:])
+
+	if NIST {
+		_, _ = h.Write([]byte{byte(K), byte(L)})
+	}
+
 	_, _ = h.Read(eSeed[:])
 
 	copy(pk.rho[:], eSeed[:32])

diff --git a/sign/dilithium/mode5/internal/dilithium.go b/sign/dilithium/mode5/internal/dilithium.go
diff --git a/sign/mldsa/mldsa44/internal/dilithium.go b/sign/mldsa/mldsa44/internal/dilithium.go
diff --git a/sign/mldsa/mldsa65/internal/dilithium.go b/sign/mldsa/mldsa65/internal/dilithium.go
diff --git a/sign/mldsa/mldsa87/internal/dilithium.go b/sign/mldsa/mldsa87/internal/dilithium.go