From 7f47e2fb1db6b3f0ef329f67b92095a9b51bf095 Mon Sep 17 00:00:00 2001 From: Chris Celi Date: Thu, 8 Aug 2024 14:31:35 -0400 Subject: [PATCH] Fixes reference again --- src/ml-dsa/sections/04-testtypes.adoc | 2 +- src/ml-dsa/sections/98-references.adoc | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/ml-dsa/sections/04-testtypes.adoc b/src/ml-dsa/sections/04-testtypes.adoc index 5f656c01..17f3cd1b 100644 --- a/src/ml-dsa/sections/04-testtypes.adoc +++ b/src/ml-dsa/sections/04-testtypes.adoc @@ -31,7 +31,7 @@ The tests described in this document have the intention of ensuring an implement [[known_answer_tests]] === Known Answer Tests -Within ML-DSA sigGen, the algorithm enters a loop until a valid signature is found. The loop contains four potential reasons to reject a candidate signature: if the z infinity norm is too large, if the r infinity norm is too large, if there are too many hints in h, or if the ct0 infinity norm is too large. These conditions occur at various rarities that can make it difficult to test each error condition with randomized testing. If an implementation adheres strictly to the pseudocode in <>, the following table provides helpful known answer tests that trigger each rejection case exactly once. If the implementation varies from the psuedocode, it would be prudent to use a debugger to ensure that all rejection cases are triggered by testing. To save on space, the table will provide the seed used to generate the key pair, and a hash of the keys, SHA2-256(pk || sk). A hash of the resulting signature is also provided, SHA2-256(sig). All cases are defined using the deterministic signature method. Note that the ct0 infinity norm check only applies to ML-DSA-44. This condition is not possible on the other security levels. Thanks to Qinglai Xiao and Mike Hamburg (Rambus Inc) for providing code to generate these test cases; more information on their technique is available on the NIST PQC-Forum <>. +Within ML-DSA sigGen, the algorithm enters a loop until a valid signature is found. The loop contains four potential reasons to reject a candidate signature: if the z infinity norm is too large, if the r infinity norm is too large, if there are too many hints in h, or if the ct0 infinity norm is too large. These conditions occur at various rarities that can make it difficult to test each error condition with randomized testing. If an implementation adheres strictly to the pseudocode in <>, the following table provides helpful known answer tests that trigger each rejection case exactly once. If the implementation varies from the psuedocode, it would be prudent to use a debugger to ensure that all rejection cases are triggered by testing. To save on space, the table will provide the seed used to generate the key pair, and a hash of the keys, SHA2-256(pk || sk). A hash of the resulting signature is also provided, SHA2-256(sig). All cases are defined using the deterministic signature method. Note that the ct0 infinity norm check only applies to ML-DSA-44. This condition is not possible on the other security levels. Thanks to Qinglai Xiao and Mike Hamburg (Rambus Inc) for providing code to generate these test cases; more information on their technique is available on the NIST PQC-Forum <>. [[kats_table]] .ML-DSA sigGen Known Answer Tests for Rejection Cases diff --git a/src/ml-dsa/sections/98-references.adoc b/src/ml-dsa/sections/98-references.adoc index ecbc82bf..0a839bc1 100644 --- a/src/ml-dsa/sections/98-references.adoc +++ b/src/ml-dsa/sections/98-references.adoc @@ -36,9 +36,9 @@ date.value:: 2019-07-01 [%bibitem] === PQC-Forum -id:: PQC-Forum +id:: PQCForum docid:: - id::: PQC-Forum + id::: PQCForum link:: link.type:: src -link.content:: https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/G8Zf0hC-uu0/m/Kb3qNJb0AwAJ \ No newline at end of file +link.content:: https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/G8Zf0hC-uu0/m/Kb3qNJb0AwAJ