Add PQCrystals-Kyber512, Remove SIKE, relocate pq_kem interface. #343
Conversation
|
This is a cleaned up version of #335, which was not caught up with main so had a lot of noise. This also removes SIKE since the plan for this branch is to only house Kyber until a NIST selection is made and then proceed with whichever KEM is the winner. |
|
Working on recreating the CI failures locally so I can address them. |
I'm not sure this approach would work that well unfortunately. The test flag What about turning this into an internal runtime configuration? you can expose an internal function (a simple wrapper) that will, at runtime, use a deterministic backend for the This is similar to what we do when testing fork detection, using runtime configurations, clearly marked with "TESTING" i.e. https://github.com/awslabs/aws-lc/blob/main/crypto/fipsmodule/rand/fork_detect.c#L200. The best way to implement this at compile-time would maybe be an extra dimension in the CI - just for this case. This can quickly lead to combinatorial explosion though. |
… fork_detect.c. Use the existing CTR_DRBG from fipsmodule/rand instead of recreating it. Modify the randombytes interface to be usable by the test without creating a duplicate copy of the functions in shared builds. Modify Kyber's verify.c logic to avoid a warning-turned-error on MSVC builds.
…#343) * Add PQCrystals-Kyber512, Remove SIKE, relocate pq_kem interface. * Use a runtime switch to enable the DRBG, similar to how it is done in fork_detect.c. * Modify Kyber's verify.c logic to avoid a warning-turned-error on MSVC builds. * Increase OID length to accommodate longer OID value for Kyber-R3.
* Add PQCrystals-Kyber512, Remove SIKE, relocate pq_kem interface. * Use a runtime switch to enable the DRBG, similar to how it is done in fork_detect.c. * Modify Kyber's verify.c logic to avoid a warning-turned-error on MSVC builds. * Increase OID length to accommodate longer OID value for Kyber-R3.
* Add PQCrystals-Kyber512, Remove SIKE, relocate pq_kem interface. * Use a runtime switch to enable the DRBG, similar to how it is done in fork_detect.c. * Modify Kyber's verify.c logic to avoid a warning-turned-error on MSVC builds. * Increase OID length to accommodate longer OID value for Kyber-R3.
…#343) * Add PQCrystals-Kyber512, Remove SIKE, relocate pq_kem interface. * Use a runtime switch to enable the DRBG, similar to how it is done in fork_detect.c. * Modify Kyber's verify.c logic to avoid a warning-turned-error on MSVC builds. * Increase OID length to accommodate longer OID value for Kyber-R3.
…#343) * Add PQCrystals-Kyber512, Remove SIKE, relocate pq_kem interface. * Use a runtime switch to enable the DRBG, similar to how it is done in fork_detect.c. * Modify Kyber's verify.c logic to avoid a warning-turned-error on MSVC builds. * Increase OID length to accommodate longer OID value for Kyber-R3.
Description of changes:
This PR imports the source code of Kyber512 from this commit of the official Kyber repository: pq-crystals/kyber@faf5c3f
The keygen, encapsulate, and decapsulate methods are exposed using a newly created pq_kem interface which is based off of previous work from Dusan Kostic in this PR: 5302e2d.
This PR also integrates the key generation and some associated methods into the EVP_PKEY APIs.
Call-outs:
Creation of a new PQ KEM interface vs OpenSSL's KEM interface
Upstream, OpenSSL now includes an EVP KEM interface. This was investigated for use, but due to the number of additional dependencies it would bring in was decided against. Should AWS-LC decide to bring in this interface from OpenSSL, Kyber can then be integrated into it as a follow-on effort.
Addition to EVP interface
In addition to simply importing the Kyber512 source code and providing an interface to the KEM methods, this PR also makes Kyber512 keys available to the EVP PKEY interface including a subset of methods for key management.
Kyber512-Ref
The source code imported is for the Reference implementation of Kyber512. This was selected for initial import due to it being platform agnostic. The optimized implementation is for AVX2 instruction sets and so priority was given to the implementation which will work on all architectures. Importing optimized versions (and higher security levels) can be done as a follow-on effort.
SHA-3/SHAKE
Kyber requires SHA-3 and SHAKE methods which are not currently available in AWS-LC. For this PR, the needed SHA-3/SHAKE dependencies are included within the Kyber512 source tree directly. Separating out a separate SHA-3/SHAKE interface in AWS-LC is out of scope, but would be a good follow-on effort to do.
DRBG
To support KAT testing, a deterministic random number generator was needed. This PR introduces the same DRBG used by the Kyber source code and uses the same randombytes interface to seed and get random bytes from it. The DRBG only gets built when the testing flag is enabled. Otherwise the existing RNG is used.
Testing:
Unit tests were added which exercise the use of Kyber512 in the pq_kem interface and the EVP interface. KAT tests from the Kyber submission to NIST's Round 3 Post-Quantum Cryptography selection process are also included. To support running the KAT tests, an additional random number generator was added which is deterministic and only built in test mode.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.