Add FALCON-DET512 via a single generated template#18
Open
nullun wants to merge 5 commits into
Open
Conversation
Mechanical, no functional change. This rewrites deterministic.c into the
form that the build's code generator emits, so that the next commit can
generate it from a template without the resulting diff being swamped by
formatting noise:
- the file-local convenience macros (FALCON_DET1024_TMPSIZE_*, the
SALTED_SIG_* sizes) are expanded inline and their #define lines removed;
- the "#define Q 12289" is hoisted to the top of the file;
- one comment that hard-coded "1024" is made parameter-agnostic;
- a handful of lines that were space-indented are normalized to tabs, so
the file matches the tab indentation the generator emits (and the rest
of the tree).
Verified that the full preprocessor output is identical to the previous
deterministic.c -- there is no functional change.
Review this commit with `git show -w` (ignore whitespace): the diff then
collapses to just the inlined macros, the hoisted Q, and the one reworded
comment, making clear the executable code is untouched.
Give the det1024 files the same explicit parameter suffix the forthcoming det512 files will use: - deterministic.c -> deterministic1024.c - tests/test_deterministic.c -> tests/test_deterministic1024.c - tests/test_deterministic_kat.h -> tests/test_deterministic1024_kat.h The Makefile targets, the CI workflow step, and the config.h reference are updated to match, and the renamed test object rule gains its previously missing dependency on the KAT header. No functional change.
Introduce deterministic.c.tmpl and scripts/gen_deterministic.sh, and generate
deterministic1024.c from them instead of maintaining it by hand. This is a
mechanical change with no functional effect: the only change to the committed
deterministic1024.c is the one-line generated-from banner.
- deterministic.c.tmpl: the Deterministic Falcon algorithm, parameterized by
DET_N, which selects the falcon_det<n>_* function family and the matching
parameter set.
- scripts/gen_deterministic.sh: given a parameter n, expands the template's
tabs so the indentation survives the C preprocessor, copies the #include
prologue verbatim, runs the rest through the preprocessor with DET_N set to
n, and restores the tab indentation with unexpand. It takes the n values to
generate as arguments (the Makefile passes one at a time), so it has no
built-in knowledge of which parameter sets exist.
- Makefile: deterministic1024.c has a rule that regenerates it from the
template whenever the template is newer, so editing the template and
running a plain "make" can never compile a stale source. "make gen"
regenerates unconditionally and "make check-gen" verifies the committed
file is in sync with the template (for CI); both are marked .PHONY so a
stray file of either name cannot satisfy the rule and silently skip the
recipe. The script is deliberately not a prerequisite of the committed
source: on a fresh clone git may check it out with a newer timestamp, and
a plain "make" must never rewrite a committed file -- so run "make gen"
after editing the script. A normal build just compiles the committed
generated file.
The previous commit renamed the hand-written file to deterministic1024.c, so the
diff here shows it is byte-for-byte that file plus the banner -- i.e. the
template reproduces the existing code exactly.
Instantiate the template for the second Falcon parameter set, n = 512
(logn = 9), alongside the existing n = 1024 variant, without duplicating the
algorithm. Both variants are now generated from the one template,
deterministic.c.tmpl, so they cannot diverge.
- deterministic.c.tmpl: add the DET_N == 512 parameter block; the algorithm
body is unchanged and shared.
- deterministic512.c: the generated n = 512 instantiation, with its own
template rule mirroring deterministic1024.c so a plain "make" regenerates
it when the template changes; the Makefile now builds it, "make gen" emits
it, and "make check-gen" verifies it too.
- deterministic.h: append the FALCON_DET512_* constants and falcon_det512_*
declarations; the det1024 section is unchanged.
- tests/test_deterministic512.c + tests/test_deterministic512_kat.h: a KAT
runner and known-answer vectors for the n = 512 variant, mirroring the
existing det1024 test, and wired into the CI workflow.
- config.h: the determinism note now points at test_deterministic512 as well
as test_deterministic1024; the det512 variant is just as sensitive to
floating-point nondeterminism, so a porter should run its KATs too.
To confirm det1024 and det512 are the same algorithm, diff the two generated
files: `diff deterministic512.c deterministic1024.c`. The only differences are
the falcon_det1024_/falcon_det512_ prefixes and the FALCON_DET1024_/FALCON_DET512_
parameter macros. The two test runners are likewise identical bar those names:
`diff tests/test_deterministic1024.c tests/test_deterministic512.c` shows only
the prefix/macro differences -- the known-answer vectors themselves live in the
separate tests/test_deterministic{1024,512}_kat.h headers and are of course
distinct.
Exposes the new det512 C API (n=512) as a parallel set of Det512-prefixed
types and functions alongside the existing unprefixed (det1024) bindings,
which remain unchanged. Mirrors the existing binding style.
New exports:
- Constants: Det512PublicKeySize, Det512PrivateKeySize,
Det512CurrentSaltVersion, Det512CTSignatureSize, Det512SignatureMaxSize,
Det512N (= 512).
- Types: Det512PublicKey, Det512PrivateKey, Det512CompressedSignature,
Det512CTSignature.
- Functions: Det512GenerateKey, Det512S1Coefficients,
Det512HashToPointCoefficients.
- Methods: Det512PrivateKey.SignCompressed;
Det512CompressedSignature.{ConvertToCT, SaltVersion};
Det512CTSignature.{SaltVersion, S2Coefficients};
Det512PublicKey.{Verify, VerifyCTSignature, Coefficients}.
Adds Go tests mirroring the existing det1024 suite: TestKATs512 verifies
compressed signing against the reference known-answer vectors, TestDet512
covers the keygen/sign/verify round trip (compressed and CT), salt version,
bad-message and bad-key rejection, and h/c/s1/s2 coefficient recomputation,
plus signature-size, nil-message, distinct-seed, nil-signature, nil-seed,
and salt-version edge cases.
There was a problem hiding this comment.
Pull request overview
This PR introduces a deterministic Falcon variant for n=512 (FALCON-DET512) alongside the existing det1024 implementation, and ensures both variants are generated from a single shared C template to prevent algorithm drift. It also extends the build/test setup and Go bindings to support the new det512 API.
Changes:
- Add DET512 C implementation and public API (
falcon_det512_*/FALCON_DET512_*) generated fromdeterministic.c.tmpl. - Add C and Go KAT/test coverage for det512, and update CI to run both det1024 and det512 KAT binaries plus a generated-code sync check.
- Update the build system (Makefile + generator script) to support regeneration and verification of generated deterministic sources.
Reviewed changes
Copilot reviewed 12 out of 14 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
tests/test_deterministic512.c |
Adds det512 C KAT runner and CT conversion checks. |
tests/test_deterministic1024.c |
Updates KAT header include name after rename. |
scripts/gen_deterministic.sh |
Adds generator script to produce deterministic implementations from the template. |
Makefile |
Builds/links det1024+det512 objects and tests; adds gen/check-gen targets. |
falcon.go |
Adds Go bindings for det512 (types, keygen, sign, verify, conversion, coeff helpers). |
falcon_test.go |
Adds Go test suite for det512 mirroring existing det1024 tests. |
deterministic512.c |
Adds generated det512 C implementation. |
deterministic1024.c |
Marks det1024 as generated and aligns it with the template output. |
deterministic.h |
Adds det512 public API macros and function declarations. |
deterministic.c.tmpl |
Introduces the single source-of-truth template for det1024/det512 generation. |
config.h |
Updates determinism guidance to reference both KAT binaries. |
.github/workflows/test.yml |
Runs make check-gen (Ubuntu), and runs both det1024 and det512 KAT binaries in CI. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+119
to
+123
| int vct = falcon_det512_get_salt_version(sigs_ct[data_len]); | ||
| if (vct != FALCON_DET512_CURRENT_SALT_VERSION) { | ||
| fprintf(stderr, "unexpected salt version: %d", v); | ||
| exit(EXIT_FAILURE); | ||
| } |
| uint8_t sig[FALCON_DET512_SIG_COMPRESSED_MAXSIZE]; | ||
| size_t sig_len; | ||
| uint8_t expected_sig[FALCON_DET512_SIG_COMPRESSED_MAXSIZE]; | ||
| uint8_t data[data_len]; |
Comment on lines
+183
to
+184
| #define FALCON_DET512_SIG_COMPRESSED_MAXSIZE FALCON_SIG_COMPRESSED_MAXSIZE(FALCON_DET512_LOGN)-40+1 | ||
| #define FALCON_DET512_SIG_CT_SIZE FALCON_SIG_CT_SIZE(FALCON_DET512_LOGN)-40+1 |
Comment on lines
+71
to
+72
| gen: deterministic.c.tmpl scripts/gen_deterministic.sh | ||
| sh scripts/gen_deterministic.sh "$(CC)" . 1024 512 |
Contributor
Author
|
Copilot's review isn't too useful here. Reviewing the entire diff doesn't really demonstrate the changes. The follow-up branch (not yet PR'ed) will address changes to the underlying C code. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds a deterministic Falcon variant for n = 512 (FALCON-DET512) alongside the existing n = 1024, generated from a single shared template so the two cannot diverge.
Best reviewed commit-by-commit:
git show -w; whitespace-ignored it's a handful of mechanical lines (inlined macros, hoistedQ). No functional change.deterministic.c→deterministic1024.c,tests/test_deterministic.c→tests/test_deterministic1024.c, and the KAT header; Makefile, CI workflow, andconfig.hreferences updated to match. No functional change.deterministic1024.cfrom a template (daa8475) - readdeterministic.c.tmpl(source of truth) andscripts/gen_deterministic.sh; thedeterministic1024.cdiff is the generated-from banner only, i.e. the template reproduces the existing det1024 code exactly. The Makefile regenerates the committed source whenever the template is newer, so a plainmakecan never compile a stale file;make genregenerates unconditionally andmake check-gen(run in CI) verifies the committed file is in sync with the template - the faithfulness proof. Both targets are.PHONY, and the script takes the parameter n as an argument (one per rule, race-free undermake -j). No functional change, no det512 yet.DET_N == 512block, the generateddeterministic512.cwith its own regeneration rule mirroring det1024's, theFALCON_DET512_*/falcon_det512_*API indeterministic.h, a KAT runner + vectors, and a CI step;config.h's determinism guidance now points at both KAT binaries. To confirm both variants are the same algorithm, diff the generated sources and the test runners - they differ only by thedet1024_/det512_prefixes andDET1024_/DET512_macros (the KAT vectors live in the separate*_kat.hheaders).Det512*block paralleling the existing (unprefixed) det1024 API.A follow-up branch fixes small pre-existing defects that this PR deliberately carries over unchanged from the det1024 code (e.g. unparenthesized signature-size macros, incomplete
.oheader prerequisites); keeping them out of this PR keeps the refactor verifiably behavior-preserving.