Repository navigation
mldsa: regenerate FIPS 204 edge cases - #278
Merged
Merged
Conversation
Regenerate stale edge cases under the final FIPS 204 derivation. Update seed, semi-expanded, and verification siblings together. Choose ExpandS third-block seeds whose long polynomial is in s1, making silent sampler corruption observable in the public key. Credit Ville Vesilehto (thevilledev) for reporting the stale ExpandS coverage in #276. Co-authored-by: OpenAI Codex <codex@openai.com>
thevilledev
approved these changes
Oct 9, 2026
thevilledev
left a comment
thevilledev
left a comment
There was a problem hiding this comment.
Thank you for picking this up! I developed the tooling I built for #276 further to check the regenerated vectors independently. The way I see it, all edge-cases are now properly covered.
I think putting the third-block polynomial in s1 is a better choice than s2. Didn't think of that.
LGTM
Member
Author
|
Awesome! Thanks for taking a look (and once again, for flagging the issue). :-) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#276 identified stale ML-DSA
ExpandScases, but the same issue affectedExpandA,SampleInBall, andPower2Roundcases across the seed, semi-expanded, and verification files. The original gendx cases predated the final FIPS 204 key-expansion derivation, which added the parameter-set domain separator toSHAKE256(xi || k || l).This regenerates the affected ML-DSA-44, ML-DSA-65, and ML-DSA-87 groups. The ML-DSA-65 third-block cases place the long stream in
s1, making silent sampler corruption observable in the public key. ThetcIds are kept the same.The generator is intentionally not included here but it is available on the companion branch, specifically this commit. The vectors were cross-checked with OpenSSL and smoke-tested against Go's standard-library implementation. Targeted mutations also confirmed that the new vectors detect faults the old corpus missed.
Resolves #276