jonmon6691
commented
1 month ago I looked a little deeper into the difference in the draft spec and the released version and it seems like this will not be a trivial change to the crate.
- Draft (Current base document of this repo's implementation): https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.205.ipd.pdf
- Released: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.205.pdf
FIPS 205 Relevant changes mentioned in the federal register announcement (https://www.federalregister.gov/documents/2024/08/14/2024-17956/announcing-issuance-of-federal-information-processing-standards-fips-fips-203-module-lattice-based#:~:text=Based%20on%20comments%20that%20were,of%20the%20message%20is%20signed.)
- FIPS 205 contains a revised specification of pre-hashing. It also now specifies domain separation to ensure that pre-hashed messages can be distinguished from non-pre-hashed messages. FIPS 205 specifies that the signature identifier should indicate whether or not the message was pre-hashed.
- FIPS 205 was revised to include tables showing the member functions for manipulating addresses, supplementing the text and the figures illustrating each of the address types. Information about compressed addresses was also revised.
- In FIPS 203, FIPS 204, and FIPS 205, the main functions now each call an internal derandomized function in order to facilitate validation of implementations of these algorithms. [...] In FIPS 204 and FIPS 205, this applies to KeyGen, Sign, and Verify. In addition, to offer misuse resistance against the possibility that keys for different parameter sets might be expanded from the same seed, domain separation was added to the key generation routine.
- Based on comments that were submitted on draft FIPS 205, the SLH-DSA signature generation and verification functions were modified to include domain separation cases in which the message is signed directly and cases in which a digest of the message is signed. The changes were made by modifying the inputs to the signing and verification functions.
My perceived checklist of changes needed to bring the codebase up to the current standard:
- [ ] Add support for pre-hash variants of the signing and verification functions
- [ ] Modify signing and verification function signatures to accept the context string (ctx) and modify them to use domain separated M'
- [ ] Factor out internal signature and verification functions (Not strictly necessary in this implementation since test fixtures could provide their own deterministic RNG to do testing, which is the reason NIST specified this change)
- [ ] Change function doc strings to align the changed Algorithm numbers with those used in the released spec
- [ ] Change comments to align the text of the algorithm steps with the released version
- [ ] Update readme and other package docs to reflect new status
- [ ] Bump major version as this will be a breaking change to the API
Non-impact to the implementation
- NIST changed how _optrand is specified in _slhsign(). But is equivalent to the old specification and current implementation
I've forked the repo to work on this but I think I might be out of my depth when it comes to adding the pre-hashed variants. I welcome feedback, or encouragement :)
integritychain
eschorn1
FIPS 205 was officially released about 4 weeks ago. A new release of this project to update the readme and address any changes (if any) from the draft to the official release would add confidence to users of the crate that it was up to date with the standard.