Add FALCON-DET512 via a single generated template#1
Draft
nullun wants to merge 5 commits into
Draft
Conversation
Mechanical, no functional change. This rewrites deterministic.c into the
form that the build's code generator emits, so that the next commit can
generate it from a template without the resulting diff being swamped by
formatting noise:
- the file-local convenience macros (FALCON_DET1024_TMPSIZE_*, the
SALTED_SIG_* sizes) are expanded inline and their #define lines removed;
- the "#define Q 12289" is hoisted to the top of the file;
- one comment that hard-coded "1024" is made parameter-agnostic;
- a handful of lines that were space-indented are normalized to tabs, so
the file matches the tab indentation the generator emits (and the rest
of the tree).
Verified that the full preprocessor output is identical to the previous
deterministic.c -- there is no functional change.
Review this commit with `git show -w` (ignore whitespace): the diff then
collapses to just the inlined macros, the hoisted Q, and the one reworded
comment, making clear the executable code is untouched.
nullun
force-pushed
the
det512-build
branch
2 times, most recently
from
e32464b to
95fc3e6
Compare
Give the det1024 files the same explicit parameter suffix the forthcoming det512 files will use: - deterministic.c -> deterministic1024.c - tests/test_deterministic.c -> tests/test_deterministic1024.c - tests/test_deterministic_kat.h -> tests/test_deterministic1024_kat.h The Makefile targets, the CI workflow step, and the config.h reference are updated to match, and the renamed test object rule gains its previously missing dependency on the KAT header. No functional change.
Introduce deterministic.c.tmpl and scripts/gen_deterministic.sh, and generate
deterministic1024.c from them instead of maintaining it by hand. This is a
mechanical change with no functional effect: the only change to the committed
deterministic1024.c is the one-line generated-from banner.
- deterministic.c.tmpl: the Deterministic Falcon algorithm, parameterized by
DET_N, which selects the falcon_det<n>_* function family and the matching
parameter set.
- scripts/gen_deterministic.sh: given a parameter n, expands the template's
tabs so the indentation survives the C preprocessor, copies the #include
prologue verbatim, runs the rest through the preprocessor with DET_N set to
n, and restores the tab indentation with unexpand. It takes the n values to
generate as arguments (the Makefile passes one at a time), so it has no
built-in knowledge of which parameter sets exist.
- Makefile: deterministic1024.c has a rule that regenerates it from the
template whenever the template is newer, so editing the template and
running a plain "make" can never compile a stale source. "make gen"
regenerates unconditionally and "make check-gen" verifies the committed
file is in sync with the template (for CI); both are marked .PHONY so a
stray file of either name cannot satisfy the rule and silently skip the
recipe. The script is deliberately not a prerequisite of the committed
source: on a fresh clone git may check it out with a newer timestamp, and
a plain "make" must never rewrite a committed file -- so run "make gen"
after editing the script. A normal build just compiles the committed
generated file.
The previous commit renamed the hand-written file to deterministic1024.c, so the
diff here shows it is byte-for-byte that file plus the banner -- i.e. the
template reproduces the existing code exactly.
Instantiate the template for the second Falcon parameter set, n = 512
(logn = 9), alongside the existing n = 1024 variant, without duplicating the
algorithm. Both variants are now generated from the one template,
deterministic.c.tmpl, so they cannot diverge.
- deterministic.c.tmpl: add the DET_N == 512 parameter block; the algorithm
body is unchanged and shared.
- deterministic512.c: the generated n = 512 instantiation, with its own
template rule mirroring deterministic1024.c so a plain "make" regenerates
it when the template changes; the Makefile now builds it, "make gen" emits
it, and "make check-gen" verifies it too.
- deterministic.h: append the FALCON_DET512_* constants and falcon_det512_*
declarations; the det1024 section is unchanged.
- tests/test_deterministic512.c + tests/test_deterministic512_kat.h: a KAT
runner and known-answer vectors for the n = 512 variant, mirroring the
existing det1024 test, and wired into the CI workflow.
- config.h: the determinism note now points at test_deterministic512 as well
as test_deterministic1024; the det512 variant is just as sensitive to
floating-point nondeterminism, so a porter should run its KATs too.
To confirm det1024 and det512 are the same algorithm, diff the two generated
files: `diff deterministic512.c deterministic1024.c`. The only differences are
the falcon_det1024_/falcon_det512_ prefixes and the FALCON_DET1024_/FALCON_DET512_
parameter macros. The two test runners are likewise identical bar those names:
`diff tests/test_deterministic1024.c tests/test_deterministic512.c` shows only
the prefix/macro differences -- the known-answer vectors themselves live in the
separate tests/test_deterministic{1024,512}_kat.h headers and are of course
distinct.
nullun
force-pushed
the
det512-build
branch
2 times, most recently
from
c2e6154 to
ad7d941
Compare
nullun
changed the title
Exposes the new det512 C API (n=512) as a parallel set of Det512-prefixed
types and functions alongside the existing unprefixed (det1024) bindings,
which remain unchanged. Mirrors the existing binding style.
New exports:
- Constants: Det512PublicKeySize, Det512PrivateKeySize,
Det512CurrentSaltVersion, Det512CTSignatureSize, Det512SignatureMaxSize,
Det512N (= 512).
- Types: Det512PublicKey, Det512PrivateKey, Det512CompressedSignature,
Det512CTSignature.
- Functions: Det512GenerateKey, Det512S1Coefficients,
Det512HashToPointCoefficients.
- Methods: Det512PrivateKey.SignCompressed;
Det512CompressedSignature.{ConvertToCT, SaltVersion};
Det512CTSignature.{SaltVersion, S2Coefficients};
Det512PublicKey.{Verify, VerifyCTSignature, Coefficients}.
Adds Go tests mirroring the existing det1024 suite: TestKATs512 verifies
compressed signing against the reference known-answer vectors, TestDet512
covers the keygen/sign/verify round trip (compressed and CT), salt version,
bad-message and bad-key rejection, and h/c/s1/s2 coefficient recomputation,
plus signature-size, nil-message, distinct-seed, nil-signature, nil-seed,
and salt-version edge cases.
nullun
force-pushed
the
det512-build
branch
3 times, most recently
from
721f405 to
bd898d2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds a deterministic Falcon variant for n = 512 (FALCON-DET512) alongside the existing n = 1024, generated from a single shared template so the two cannot diverge.
Best reviewed commit-by-commit:
git show -w; whitespace-ignored it's a handful of mechanical lines (inlined macros, hoistedQ). No functional change.deterministic.c→deterministic1024.c,tests/test_deterministic.c→tests/test_deterministic1024.c, and the KAT header; Makefile, CI workflow, andconfig.hreferences updated to match. No functional change.deterministic1024.cfrom a template (daa8475) — readdeterministic.c.tmpl(source of truth) andscripts/gen_deterministic.sh; thedeterministic1024.cdiff is the generated-from banner only, i.e. the template reproduces the existing det1024 code exactly. The Makefile regenerates the committed source whenever the template is newer, so a plainmakecan never compile a stale file;make genregenerates unconditionally andmake check-gen(run in CI) verifies the committed file is in sync with the template — the faithfulness proof. Both targets are.PHONY, and the script takes the parameter n as an argument (one per rule, race-free undermake -j). No functional change, no det512 yet.DET_N == 512block, the generateddeterministic512.cwith its own regeneration rule mirroring det1024's, theFALCON_DET512_*/falcon_det512_*API indeterministic.h, a KAT runner + vectors, and a CI step;config.h's determinism guidance now points at both KAT binaries. To confirm both variants are the same algorithm, diff the generated sources and the test runners — they differ only by thedet1024_/det512_prefixes andDET1024_/DET512_macros (the KAT vectors live in the separate*_kat.hheaders).Det512*block paralleling the existing (unprefixed) det1024 API.A follow-up branch fixes small pre-existing defects that this PR deliberately carries over unchanged from the det1024 code (e.g. unparenthesized signature-size macros, incomplete
.oheader prerequisites); keeping them out of this PR keeps the refactor verifiably behavior-preserving.