Big-Endian missing conversions

[smuellerDD]

When using Dilithium on Big-Endian systems, the following functions perform a type cast from uint16_t to uint8_t. This type cast leads to wrong data and thus to wrong calculations:

polyvec_matrix_expand

polyvecl_uniform_eta

polyvecl_uniform_gamma1

polyveck_uniform_eta

For a fix, please see [1] for a working solution. [2] Shows the success of this change.

[1] https://github.com/smuellerDD/leancrypto/commit/f24f8f462cecef4fd0b31a08827e8f79599d128b

[2] https://build.opensuse.org/project/show/home:smuellerDD

[bhess]

Could you point to where the uint16_t to uint8_t casts occur in this repository?

It seems that the 16-bit nonces are used independent of endianness.

[cryptojedi]

This is happening in symmetric-shake.c in functions dilithium_shake128_stream_init and dilithium_shake256_stream_init.

[bhess]

This is happening in symmetric-shake.c in functions dilithium_shake128_stream_init and dilithium_shake256_stream_init.

These look ok to me - also on big-endian:

https://github.com/pq-crystals/dilithium/blob/3e9b9f1412f6c7435dbeb4e10692ea58f181ee51/ref/symmetric-shake.c#L20-L22

The "leancrypto" library seems to cast the nonce to uint8_t*. The reported issue might apply only there:

https://github.com/smuellerDD/leancrypto/blob/4c7222f11fec6addef419875eff5c6224b42714a/signature/src/dilithium_poly.c#L86

[smuellerDD]

You are absolutely correct. The pq-crystals code correctly handles the nonce in the _init functions, i.e. there is no type cast. The leancrypto code requires the byteswap as it type casts it.

Sorry for the false bug report.