symbolicsoft / kyber-k2so Goto Github PK

Hey. I'm noticing some behaviour that might not be intended, or at least it is undocumented.

In the code at: https://github.com/symbolicsoft/kyber-k2so/blob/master/indcpa.go#L165

publicSeed, noiseSeed := buf[:paramsSymBytes], buf[paramsSymBytes:]
a, err := indcpaGenMatrix(publicSeed, false, paramsK)

After running indcpaGenMatrix, noiseSeed changes its first two bytes.
Is this the intended behaviour?

I replicate this deterministically by disabling any random sampling in the code.

This bit of code is used in compressing a polynomial ring element into a (secret) message:

To do so, it performs a division by Q that might not necessarily compile to a multiplication instruction: looking at the output of some C compilers using https://godbolt.org/z/sKn3TKKGq and https://godbolt.org/z/8GqKoTfYh for example, a division instruction is emitted even when -O3 is specified. Should a division instruction be emitted, its execution time would likely be variable and leak information about its secret input.

We reported a similar issue in the CRYSTALS-Kyber reference implementation; you may want to use their fix: pq-crystals/kyber@dda29cc

func KemEncrypt(publicKey [paramsPublicKeyBytes]byte) ([paramsIndcpaBytes]byte, [paramsSymBytes]byte, error) {

There's no way for anyone to use this API for real, because the array sizes cannot be referenced outside this package.

Try to move your tests from package kyberk2so to package kyberk2so_test to feel the pain yourself.