Compatibility with npmjs.com/package/dilithium-crystals about circl

[decentralgabe]

Thanks @bwesterb I'll close this issue. I did not notice that you're in compliance with existing test vectors.

[decentralgabe]

To throw another wrench into the mix I've also tried verifying signatures generated from this java implementation which appears on the official Dilithium site.

The code this snippet outputs could not be verified by either this library or the JS one 😕 .

	public void vectors() throws Exception {
		DilithiumProvider pv = new DilithiumProvider();
		KeyPairGenerator kpg = KeyPairGenerator.getInstance("Dilithium", pv);
		kpg.initialize(DilithiumParameterSpec.LEVEL5);
		KeyPair kp = kpg.generateKeyPair();

		Signature signature = Signature.getInstance("Dilithium", pv);
		signature.initSign(kp.getPrivate());
		byte[] text = new byte[]{0,1,2,3,4,5};
		signature.update(text);
		byte[] sig = signature.sign();

		// Check we can verify with the correct public key
		signature.initVerify(kp.getPublic());
		signature.update(text);
		assertTrue(signature.verify(sig));

		System.out.printf("Public Key: %s\n", bytesToHex(kp.getPublic().getEncoded()));
		System.out.printf("Signature: %s", bytesToHex(sig));
	}
	
	public static String bytesToHex(byte[] bytes) {
		StringBuilder hex = new StringBuilder();
		for (byte b : bytes) {
			hex.append(String.format("%02X", b));
		}
		return hex.toString();
	}

[bwesterb]

Here is a clue: the signature generated by javascript is 4602 bytes, whereas the one generated by CIRCL is 4595 bytes. The Dilithium spec lists the correct signature size to be 4595. We check test vectors against the reference implementation.

[bwesterb]

Looking at the source code of the JS package you are using:

long dilithiumjs_sign (
	uint8_t *sig,
	const uint8_t *m,
	unsigned long mlen,
	const uint8_t *sk
) {
	size_t siglen;

	int status	= PQCLEAN_DILITHIUM5_CLEAN_crypto_sign_signature(
		sig + sizeof(unsigned short),
		&siglen,
		m,
		mlen,
		sk
	);

	if (status == 0) {
		*((unsigned short*) sig)	= (unsigned short) siglen;
	}

	return status;
}

long dilithiumjs_verify (
	const uint8_t *m,
	unsigned long mlen,
	const uint8_t *sig,
	const uint8_t *pk
) {
	size_t siglen	= (size_t) *((unsigned short*) sig);

	return PQCLEAN_DILITHIUM5_CLEAN_crypto_sign_verify(
		sig + sizeof(unsigned short),
		siglen,
		m,
		mlen,
		pk
	);
}

I would not use that package.

[armfazh]

maybe this is something to raise to the back-end library to check whether that implementation is compliant with the latest test vectors.