Add FALCON-DET512 via a single generated template

.github/workflows/test.yml

@@ -26,10 +26,15 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
+      - name: Check generated code is in sync
+        if: matrix.os == 'ubuntu-latest'
+        run: make check-gen
       - name: Build C tests
         run: make
-      - name: Deterministic KAT tests
-        run: ./tests/test_deterministic
+      - name: Deterministic-1024 KAT tests
+        run: ./tests/test_deterministic1024
+      - name: Deterministic-512 KAT tests
+        run: ./tests/test_deterministic512
       - name: Falcon tests
         run: ./tests/test_falcon
       - name: Speed smoke test

Makefile

@@ -51,15 +51,47 @@ LIBS = #-lm
 
 # =====================================================================
 
-OBJ = codec.o common.o deterministic.o falcon.o fft.o fpr.o keygen.o rng.o shake.o sign.o vrfy.o
+OBJ = codec.o common.o deterministic1024.o deterministic512.o falcon.o fft.o fpr.o keygen.o rng.o shake.o sign.o vrfy.o
 
-all: tests/test_deterministic tests/test_falcon tests/speed
+all: tests/test_deterministic1024 tests/test_deterministic512 tests/test_falcon tests/speed
 
 clean:
-	-rm -f $(OBJ) tests/test_deterministic tests/test_deterministic.o tests/test_falcon tests/test_falcon.o tests/speed tests/speed.o
-
-tests/test_deterministic: tests/test_deterministic.o $(OBJ)
-	$(LD) $(LDFLAGS) -o tests/test_deterministic tests/test_deterministic.o $(OBJ) $(LIBS)
+	-rm -f $(OBJ) tests/test_deterministic1024 tests/test_deterministic1024.o tests/test_deterministic512 tests/test_deterministic512.o tests/test_falcon tests/test_falcon.o tests/speed tests/speed.o
+
+# The deterministic<n>.c sources are generated from the single template
+# deterministic.c.tmpl and committed to the repository, so a normal build just
+# compiles them. Each has a rule below that regenerates it first if the
+# template has been edited; "make gen" regenerates them unconditionally. Run
+# "make gen" after editing scripts/gen_deterministic.sh too: the script is
+# deliberately not a prerequisite of the committed sources, since on a fresh
+# clone git may check it out with a newer timestamp than them and a plain
+# "make" must never rewrite committed sources. "make check-gen" verifies the
+# committed sources are in sync with the template (useful in CI).
+.PHONY: gen check-gen
+gen: deterministic.c.tmpl scripts/gen_deterministic.sh
+	sh scripts/gen_deterministic.sh "$(CC)" . 1024 512
+
+check-gen: deterministic.c.tmpl scripts/gen_deterministic.sh
+	@tmp=`mktemp -d`; \
+	sh scripts/gen_deterministic.sh "$(CC)" "$$tmp" 1024 512; \
+	rc=0; \
+	cmp -s "$$tmp/deterministic1024.c" deterministic1024.c || { echo "ERROR: deterministic1024.c is out of sync with deterministic.c.tmpl"; rc=1; }; \
+	cmp -s "$$tmp/deterministic512.c" deterministic512.c || { echo "ERROR: deterministic512.c is out of sync with deterministic.c.tmpl"; rc=1; }; \
+	rm -rf "$$tmp"; \
+	if [ $$rc -eq 0 ]; then echo "OK: deterministic1024.c and deterministic512.c are in sync with deterministic.c.tmpl"; else echo "Run 'make gen' to regenerate."; fi; \
+	exit $$rc
+
+deterministic1024.c: deterministic.c.tmpl
+	sh scripts/gen_deterministic.sh "$(CC)" . 1024
+
+deterministic512.c: deterministic.c.tmpl
+	sh scripts/gen_deterministic.sh "$(CC)" . 512
+
+tests/test_deterministic1024: tests/test_deterministic1024.o $(OBJ)
+	$(LD) $(LDFLAGS) -o tests/test_deterministic1024 tests/test_deterministic1024.o $(OBJ) $(LIBS)
+
+tests/test_deterministic512: tests/test_deterministic512.o $(OBJ)
+	$(LD) $(LDFLAGS) -o tests/test_deterministic512 tests/test_deterministic512.o $(OBJ) $(LIBS)
 
 tests/test_falcon: tests/test_falcon.o $(OBJ)
 	$(LD) $(LDFLAGS) -o tests/test_falcon tests/test_falcon.o $(OBJ) $(LIBS)
@@ -73,8 +105,11 @@ codec.o: codec.c config.h inner.h fpr.h
 common.o: common.c config.h inner.h fpr.h
 	$(CC) $(CFLAGS) -c -o common.o common.c
 
-deterministic.o: deterministic.c deterministic.h falcon.h
-	$(CC) $(CFLAGS) -c -o deterministic.o deterministic.c
+deterministic1024.o: deterministic1024.c deterministic.h falcon.h
+	$(CC) $(CFLAGS) -c -o deterministic1024.o deterministic1024.c
+
+deterministic512.o: deterministic512.c deterministic.h falcon.h
+	$(CC) $(CFLAGS) -c -o deterministic512.o deterministic512.c
 
 falcon.o: falcon.c falcon.h config.h inner.h fpr.h
 	$(CC) $(CFLAGS) -c -o falcon.o falcon.c
@@ -103,8 +138,11 @@ tests/speed.o: tests/speed.c falcon.h
 tests/test_falcon.o: tests/test_falcon.c falcon.h config.h inner.h fpr.h
 	$(CC) $(CFLAGS) -c -o tests/test_falcon.o tests/test_falcon.c
 
-tests/test_deterministic.o: tests/test_deterministic.c deterministic.h falcon.h config.h inner.h fpr.h
-	$(CC) $(CFLAGS) -c -o tests/test_deterministic.o tests/test_deterministic.c
+tests/test_deterministic1024.o: tests/test_deterministic1024.c tests/test_deterministic1024_kat.h deterministic.h falcon.h config.h inner.h fpr.h
+	$(CC) $(CFLAGS) -c -o tests/test_deterministic1024.o tests/test_deterministic1024.c
+
+tests/test_deterministic512.o: tests/test_deterministic512.c tests/test_deterministic512_kat.h deterministic.h falcon.h config.h inner.h fpr.h
+	$(CC) $(CFLAGS) -c -o tests/test_deterministic512.o tests/test_deterministic512.c
 
 vrfy.o: vrfy.c config.h inner.h fpr.h
 	$(CC) $(CFLAGS) -c -o vrfy.o vrfy.c

config.h

@@ -79,10 +79,10 @@
  * for the same message (under the same secret key).
  *
  * Determinism can be sanity-checked (but not guaranteed) using the
- * provided KATs, via test_deterministic. Any deviation from the
- * expected results indicates a lack of the desired determinism;
- * however, agreement does not prove determinism for all possible
- * inputs.
+ * provided KATs, via test_deterministic1024 and test_deterministic512.
+ * Any deviation from the expected results indicates a lack of the
+ * desired determinism; however, agreement does not prove determinism
+ * for all possible inputs.
  */
 #define FALCON_FPEMU  1