V1.1

README.md

@@ -1,12 +1,12 @@
 # MEDS
 ## Matrix Equivalence Digital Signature
 
-This repository procides the reference implentation of the PQC signature scheme MEDS
+This repository provides the reference implementation of the PQC signature scheme MEDS
 as submitted to the NIST PQC Signature standardization process.
 
 The website accompanying the MEDS submission is [meds-pqc.org](https://www.meds-pqc.org/).
 
-The submission document with the MEDS specificaiton can be found [here](https://www.meds-pqc.org/spec/MEDS-2023-05-31.pdf).
+The submission document with the MEDS specification can be found [here](https://www.meds-pqc.org/spec/MEDS-2023-05-31.pdf).
 
 ## Compile
 
@@ -15,8 +15,8 @@ using the provided Makefile.
 
 We provide three programs:
 `test` to run at test of key generation, signing, and verification,
-`bench` for benchmarling the implentation using several rund, and
-`KAT_test` for computing known answert tests.
+`bench` for benchmarking the implementation using several rounds, and
+`KAT_test` for computing known answer tests.
 
 The test can be compiled and run by
 

ref/log.h

@@ -38,6 +38,16 @@
   fprintf(stderr, "\n\n"); \
 } while (0)
 
+#define LOG_HEX_FMT(v, len, fmt, ...) do { \
+  if (sizeof( (char[]){#__VA_ARGS__} ) == 1) \
+    fprintf(stderr, "(%s) " fmt ":\n0x", __func__, ##__VA_ARGS__); \
+  else \
+    fprintf(stderr, "(%s) " fmt ":\n0x", __func__, ##__VA_ARGS__); \
+  for (int _log_i = 0; _log_i < len; _log_i++) \
+    fprintf(stderr, "%02x", (v)[_log_i]); \
+  fprintf(stderr, "\n\n"); \
+} while (0)
+
 #define LOG_MAT(v, m, n, ...) do { \
   if (sizeof( (char[]){#__VA_ARGS__} ) == 1) \
     fprintf(stderr, "(%s) " #v ":\n", __func__); \
@@ -64,6 +74,7 @@
 #define LOG_VEC_FMT(v, len, fmt, ...) do { } while(0);
 
 #define LOG_HEX(v, len, ...) do { } while(0);
+#define LOG_HEX_FMT(v, len, fmt, ...) do { } while(0);
 
 #define LOG_MAT(v, m, n, ...) do { } while(0);
 #define LOG_MAT_FMT(v, m, n, fmt, ...) do { } while(0);

ref/meds.c

@@ -303,6 +303,10 @@ int crypto_sign(
 
   uint8_t *sigma = &stree[MEDS_st_seed_bytes * SEED_TREE_ADDR(MEDS_seed_tree_height, 0)];
 
+  for (int i = 0; i < MEDS_t; i++)
+  {
+     LOG_HEX_FMT((&sigma[i*MEDS_st_seed_bytes]), MEDS_st_seed_bytes, "sigma[%i]", i);
+  }
 
   pmod_mat_t A_tilde_data[MEDS_t * MEDS_m * MEDS_m];
   pmod_mat_t B_tilde_data[MEDS_t * MEDS_m * MEDS_m];
@@ -316,6 +320,13 @@ int crypto_sign(
     B_tilde[i] = &B_tilde_data[i * MEDS_n * MEDS_n];
   }
 
+
+  uint8_t seed_buf[MEDS_st_salt_bytes + MEDS_st_seed_bytes + sizeof(uint32_t)] = {0};
+  memcpy(seed_buf, alpha, MEDS_st_salt_bytes);
+
+  uint8_t *addr_pos = seed_buf + MEDS_st_salt_bytes + MEDS_st_seed_bytes;
+
+
   keccak_state h_shake;
   shake256_init(&h_shake);
 
@@ -325,17 +336,26 @@ int crypto_sign(
 
     while (1 == 1)
     {
-      uint8_t sigma_A_tilde_i[MEDS_st_seed_bytes];
-      uint8_t sigma_B_tilde_i[MEDS_st_seed_bytes];
+      uint8_t sigma_A_tilde_i[MEDS_pub_seed_bytes];
+      uint8_t sigma_B_tilde_i[MEDS_pub_seed_bytes];
+
+      for (int j = 0; j < 4; j++)
+        addr_pos[j] = (i >> (j*8)) & 0xff;
+
+      memcpy(seed_buf + MEDS_st_salt_bytes, &sigma[i*MEDS_st_seed_bytes], MEDS_st_seed_bytes);
+
+      LOG_HEX_FMT(seed_buf, MEDS_st_salt_bytes + MEDS_st_seed_bytes + 4, "sigma_prime[%i]", i);
 
       XOF((uint8_t*[]){sigma_A_tilde_i, sigma_B_tilde_i, &sigma[i*MEDS_st_seed_bytes]},
-           (size_t[]){MEDS_st_seed_bytes, MEDS_st_seed_bytes, MEDS_st_seed_bytes},
-           &sigma[i*MEDS_st_seed_bytes], MEDS_st_seed_bytes,
+           (size_t[]){MEDS_pub_seed_bytes, MEDS_pub_seed_bytes, MEDS_st_seed_bytes},
+           seed_buf, MEDS_st_salt_bytes + MEDS_st_seed_bytes + 4,
            3);
 
+      LOG_HEX_FMT(sigma_A_tilde_i, MEDS_pub_seed_bytes, "sigma_A_tilde[%i]", i);
+      rnd_inv_matrix(A_tilde[i], MEDS_m, MEDS_m, sigma_A_tilde_i, MEDS_pub_seed_bytes);
 
-      rnd_inv_matrix(A_tilde[i], MEDS_m, MEDS_m, sigma_A_tilde_i, MEDS_st_seed_bytes);
-      rnd_inv_matrix(B_tilde[i], MEDS_n, MEDS_n, sigma_B_tilde_i, MEDS_st_seed_bytes);
+      LOG_HEX_FMT(sigma_B_tilde_i, MEDS_pub_seed_bytes, "sigma_B_tilde[%i]", i);
+      rnd_inv_matrix(B_tilde[i], MEDS_n, MEDS_n, sigma_B_tilde_i, MEDS_pub_seed_bytes);
 
       LOG_MAT_FMT(A_tilde[i], MEDS_m, MEDS_m, "A_tilde[%i]", i);
       LOG_MAT_FMT(B_tilde[i], MEDS_n, MEDS_n, "B_tilde[%i]", i);
@@ -441,6 +461,7 @@ int crypto_sign_open(
     const unsigned char *pk
   )
 {
+  LOG_HEX(pk, MEDS_PK_BYTES);
   LOG_HEX(sm, smlen);
 
   pmod_mat_t G_data[MEDS_k*MEDS_m*MEDS_n * MEDS_s];
@@ -488,11 +509,16 @@ int crypto_sign_open(
   for (int i = 0; i < MEDS_s; i++)
     LOG_MAT_FMT(G[i], MEDS_k, MEDS_m*MEDS_n, "G[%i]", i);
 
+  LOG_HEX_FMT(sm, MEDS_w * (CEILING(MEDS_m*MEDS_m * GFq_bits, 8) + CEILING(MEDS_n*MEDS_n * GFq_bits, 8)), "munu");
+  LOG_HEX_FMT(sm + MEDS_w * (CEILING(MEDS_m*MEDS_m * GFq_bits, 8) + CEILING(MEDS_n*MEDS_n * GFq_bits, 8)),
+      MEDS_max_path_len * MEDS_st_seed_bytes, "path");
+
   uint8_t *digest = (uint8_t*)sm + (MEDS_SIG_BYTES - MEDS_digest_bytes - MEDS_st_salt_bytes);
 
   uint8_t *alpha = (uint8_t*)sm + (MEDS_SIG_BYTES - MEDS_st_salt_bytes);
 
-  LOG_VEC(digest, MEDS_digest_bytes);
+  LOG_HEX(digest, MEDS_digest_bytes);
+  LOG_HEX(alpha, MEDS_st_salt_bytes);
 
   uint8_t h[MEDS_t];
 
@@ -516,6 +542,13 @@ int crypto_sign_open(
   pmod_mat_t mu[MEDS_m*MEDS_m];
   pmod_mat_t nu[MEDS_n*MEDS_n];
 
+
+  uint8_t seed_buf[MEDS_st_salt_bytes + MEDS_st_seed_bytes + sizeof(uint32_t)] = {0};
+  memcpy(seed_buf, alpha, MEDS_st_salt_bytes);
+
+  uint8_t *addr_pos = seed_buf + MEDS_st_salt_bytes + MEDS_st_seed_bytes;
+
+
   keccak_state shake;
   shake256_init(&shake);
 
@@ -524,26 +557,59 @@ int crypto_sign_open(
     if (h[i] > 0)
     {
       for (int j = 0; j < MEDS_m*MEDS_m; j++)
-        mu[j] = bs_read(&bs, GFq_bits);
+        mu[j] = bs_read(&bs, GFq_bits) % MEDS_p;
 
       bs_finalize(&bs);
 
       for (int j = 0; j < MEDS_n*MEDS_n; j++)
-        nu[j] = bs_read(&bs, GFq_bits);
+        nu[j] = bs_read(&bs, GFq_bits) % MEDS_p;
 
       bs_finalize(&bs);
 
 
       LOG_MAT_FMT(mu, MEDS_m, MEDS_m, "mu[%i]", i);
       LOG_MAT_FMT(nu, MEDS_n, MEDS_n, "nu[%i]", i);
 
+      // Check if mu is invetible.
+      {
+        pmod_mat_t tmp_mu[MEDS_m*MEDS_m];
+
+        memcpy(tmp_mu, mu, MEDS_m*MEDS_m*sizeof(GFq_t));
+
+        if (pmod_mat_syst_ct(tmp_mu, MEDS_m, MEDS_m) != 0)
+        {
+          fprintf(stderr, "Signature verification failed; malformed signature!\n");
+
+          return -1;
+        }
+      }
+
+      // Check if nu is invetible.
+      {
+        pmod_mat_t tmp_nu[MEDS_n*MEDS_n];
+
+        memcpy(tmp_nu, nu, MEDS_n*MEDS_n*sizeof(GFq_t));
+
+        if (pmod_mat_syst_ct(tmp_nu, MEDS_n, MEDS_n) != 0)
+        {
+          fprintf(stderr, "Signature verification failed; malformed signature!\n");
+
+          return -1;
+        }
+      }
+
 
       pi(G_hat_i, mu, nu, G[h[i]]);
 
 
       LOG_MAT_FMT(G_hat_i, MEDS_k, MEDS_m*MEDS_n, "G_hat[%i]", i);
 
-      pmod_mat_syst_ct(G_hat_i, MEDS_k, MEDS_m*MEDS_n);
+      if (pmod_mat_syst_ct(G_hat_i, MEDS_k, MEDS_m*MEDS_n) < 0)
+      {
+        fprintf(stderr, "Signature verification failed!\n");
+
+        return -1;
+      }
 
       LOG_MAT_FMT(G_hat_i, MEDS_k, MEDS_m*MEDS_n, "G_hat[%i]", i);
     }
@@ -553,28 +619,35 @@ int crypto_sign_open(
       {
         LOG_VEC_FMT(&sigma[i*MEDS_st_seed_bytes], MEDS_st_seed_bytes, "seeds[%i]", i);
 
-        uint8_t sigma_A_tilde_i[MEDS_st_seed_bytes];
-        uint8_t sigma_B_tilde_i[MEDS_st_seed_bytes];
+        uint8_t sigma_A_hat_i[MEDS_pub_seed_bytes];
+        uint8_t sigma_B_hat_i[MEDS_pub_seed_bytes];
+
+        for (int j = 0; j < 4; j++)
+          addr_pos[j] = (i >> (j*8)) & 0xff;
+
+        memcpy(seed_buf + MEDS_st_salt_bytes, &sigma[i*MEDS_st_seed_bytes], MEDS_st_seed_bytes);
+
+        LOG_HEX_FMT(seed_buf, MEDS_st_salt_bytes + MEDS_st_seed_bytes + 4, "sigma_prime[%i]", i);
 
-        XOF((uint8_t*[]){sigma_A_tilde_i, sigma_B_tilde_i, &sigma[i*MEDS_st_seed_bytes]},
-            (size_t[]){MEDS_st_seed_bytes, MEDS_st_seed_bytes, MEDS_st_seed_bytes},
-            &sigma[i*MEDS_st_seed_bytes], MEDS_st_seed_bytes,
+        XOF((uint8_t*[]){sigma_A_hat_i, sigma_B_hat_i, &sigma[i*MEDS_st_seed_bytes]},
+            (size_t[]){MEDS_pub_seed_bytes, MEDS_pub_seed_bytes, MEDS_st_seed_bytes},
+            seed_buf, MEDS_st_salt_bytes + MEDS_st_seed_bytes + 4,
             3);
 
-        pmod_mat_t A_tilde[MEDS_m*MEDS_m];
-        pmod_mat_t B_tilde[MEDS_n*MEDS_n];
+        pmod_mat_t A_hat_i[MEDS_m*MEDS_m];
+        pmod_mat_t B_hat_i[MEDS_n*MEDS_n];
 
-        LOG_VEC(sigma_A_tilde_i, MEDS_sec_seed_bytes);
-        rnd_inv_matrix(A_tilde, MEDS_m, MEDS_m, sigma_A_tilde_i, MEDS_st_seed_bytes);
+        LOG_HEX_FMT(sigma_A_hat_i, MEDS_pub_seed_bytes, "sigma_A_hat[%i]", i);
+        rnd_inv_matrix(A_hat_i, MEDS_m, MEDS_m, sigma_A_hat_i, MEDS_pub_seed_bytes);
 
-        LOG_VEC(sigma_B_tilde_i, MEDS_sec_seed_bytes);
-        rnd_inv_matrix(B_tilde, MEDS_n, MEDS_n, sigma_B_tilde_i, MEDS_st_seed_bytes);
+        LOG_HEX_FMT(sigma_B_hat_i, MEDS_pub_seed_bytes, "sigma_B_hat[%i]", i);
+        rnd_inv_matrix(B_hat_i, MEDS_n, MEDS_n, sigma_B_hat_i, MEDS_pub_seed_bytes);
 
-        LOG_MAT_FMT(A_tilde, MEDS_m, MEDS_m, "A_tilde[%i]", i);
-        LOG_MAT_FMT(B_tilde, MEDS_n, MEDS_n, "B_tilde[%i]", i);
+        LOG_MAT_FMT(A_hat_i, MEDS_m, MEDS_m, "A_hat[%i]", i);
+        LOG_MAT_FMT(B_hat_i, MEDS_n, MEDS_n, "B_hat[%i]", i);
 
 
-        pi(G_hat_i, A_tilde, B_tilde, G[0]);
+        pi(G_hat_i, A_hat_i, B_hat_i, G[0]);
 
         LOG_MAT_FMT(G_hat_i, MEDS_k, MEDS_m*MEDS_n, "G_hat[%i]", i);