nebius/SWE-rebench-V2-PRs huggingface dataset:
Repository: randombit/botan
Pull request #3301 (2023-02-17 23:06:49)

Add Dilithium to cli speed tool


Patch:
diff --git a/src/cli/speed.cpp b/src/cli/speed.cpp
index d6ee7b0c5..40d1eb2d3 100644
--- a/src/cli/speed.cpp
+++ b/src/cli/speed.cpp
@@ -115,6 +115,10 @@
    #include <botan/kyber.h>
 #endif
 
+#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES)
+   #include <botan/dilithium.h>
+#endif
+
 #if defined(BOTAN_HAS_ECDSA)
    #include <botan/ecdsa.h>
 #endif
@@ -639,6 +643,12 @@ class Speed final : public Command
                bench_kyber(provider, msec);
                }
 #endif
+#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES)
+            else if(algo == "Dilithium")
+               {
+               bench_dilithium(provider, msec);
+               }
+#endif
 #if defined(BOTAN_HAS_XMSS_RFC8391)
             else if(algo == "XMSS")
                {
@@ -2220,6 +2230,47 @@ class Speed final : public Command
          }
 #endif
 
+#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES)
+      void bench_dilithium(const std::string& provider,
+                       std::chrono::milliseconds msec)
+         {
+         const Botan::DilithiumMode::Mode all_modes[] = {
+            Botan::DilithiumMode::Dilithium4x4,
+            Botan::DilithiumMode::Dilithium4x4_AES,
+            Botan::DilithiumMode::Dilithium6x5,
+            Botan::DilithiumMode::Dilithium6x5_AES,
+            Botan::DilithiumMode::Dilithium8x7,
+            Botan::DilithiumMode::Dilithium8x7_AES
+         };
+
+         for(auto modet: all_modes)
+            {
+            Botan::DilithiumMode mode(modet);
+
+#if !defined(BOTAN_HAS_DILITHIUM)
+            if(mode.is_modern())
+               continue;
+#endif
+
+#if !defined(BOTAN_HAS_DILITHIUM_AES)
+            if(mode.is_aes())
+               continue;
+#endif
+
+            auto keygen_timer = make_timer(mode.to_string(), provider, "keygen");
+
+            auto key = keygen_timer->run([&]
+               {
+               return Botan::Dilithium_PrivateKey(rng(), mode);
+               });
+
+            record_result(keygen_timer);
+
+            bench_pk_sig(key, mode.to_string(), provider, "", msec);
+            }
+         }
+#endif
+
 #if defined(BOTAN_HAS_XMSS_RFC8391)
       void bench_xmss(const std::string& provider,
                       std::chrono::milliseconds msec)


Test patch:
diff --git a/src/scripts/test_cli.py b/src/scripts/test_cli.py
index de5abb15c..a7dd50bad 100755
--- a/src/scripts/test_cli.py
+++ b/src/scripts/test_cli.py
@@ -1195,7 +1195,7 @@ def cli_speed_pk_tests(_tmp_dir):
 
     pk_algos = ["ECDSA", "ECDH", "SM2", "ECKCDSA", "ECGDSA", "GOST-34.10",
                 "DH", "DSA", "ElGamal", "Ed25519", "Curve25519", "McEliece",
-                "RSA", "RSA_keygen", "XMSS", "ec_h2c", "Kyber"]
+                "RSA", "RSA_keygen", "XMSS", "ec_h2c", "Kyber", "Dilithium"]
 
     output = test_cli("speed", ["--msec=%d" % (msec)] + pk_algos, None).split('\n')
Repository: randombit/botan
Pull request #3382 (2023-03-15 12:43:44)

Fix EAX nonce handling bug
Backport of #3335


Patch:
diff --git a/src/lib/modes/aead/eax/eax.cpp b/src/lib/modes/aead/eax/eax.cpp
index 4f6b540ff..7c5fe583c 100644
--- a/src/lib/modes/aead/eax/eax.cpp
+++ b/src/lib/modes/aead/eax/eax.cpp
@@ -145,6 +145,8 @@ void EAX_Encryption::finish(secure_vector<uint8_t>& buffer, size_t offset)
    xor_buf(data_mac, m_ad_mac, data_mac.size());
 
    buffer += std::make_pair(data_mac.data(), tag_size());
+
+   m_nonce_mac.clear();
    }
 
 size_t EAX_Decryption::process(uint8_t buf[], size_t sz)
@@ -183,12 +185,14 @@ void EAX_Decryption::finish(secure_vector<uint8_t>& buffer, size_t offset)
 
    mac ^= m_ad_mac;
 
-   if(!constant_time_compare(mac.data(), included_tag, tag_size()))
-      throw Invalid_Authentication_Tag("EAX tag check failed");
+   bool accept_mac = constant_time_compare(mac.data(), included_tag, tag_size());
 
    buffer.resize(offset + remaining);
 
    m_nonce_mac.clear();
+
+   if(!accept_mac)
+      throw Invalid_Authentication_Tag("EAX tag check failed");
    }
 
 }


Test patch:
diff --git a/src/tests/test_aead.cpp b/src/tests/test_aead.cpp
index 26e85a01d..8c5d5681e 100644
--- a/src/tests/test_aead.cpp
+++ b/src/tests/test_aead.cpp
@@ -172,6 +172,8 @@ class AEAD_Tests final : public Text_Based_Test
                }
             }
 
+         // Make sure we can set the AD after processing a message
+         enc->set_ad(ad);
          enc->clear();
 
          result.test_throws("Unkeyed object throws for encrypt after clear",
@@ -401,6 +403,8 @@ class AEAD_Tests final : public Text_Based_Test
             result.test_failure("unexpected error while rejecting modified nonce", e.what());
             }
 
+         // Make sure we can set the AD after processing a message
+         dec->set_ad(ad);
          dec->clear();
 
          result.test_throws("Unkeyed object throws for decrypt",
Repository: randombit/botan
Pull request #3383 (2023-03-15 12:48:42)

Backport #3340 Fix NIST keywrap for 8 byte inputs


Patch:
diff --git a/src/lib/misc/nist_keywrap/nist_keywrap.cpp b/src/lib/misc/nist_keywrap/nist_keywrap.cpp
index 671d31ea4..1db24ed44 100644
--- a/src/lib/misc/nist_keywrap/nist_keywrap.cpp
+++ b/src/lib/misc/nist_keywrap/nist_keywrap.cpp
@@ -106,7 +106,24 @@ nist_key_wrap(const uint8_t input[],
    if(input_len % 8 != 0)
       throw Invalid_Argument("Bad input size for NIST key wrap");
 
-   return raw_nist_key_wrap(input, input_len, bc, 0xA6A6A6A6A6A6A6A6);
+   const uint64_t ICV = 0xA6A6A6A6A6A6A6A6;
+
+   if(input_len == 8)
+      {
+      /*
+      * Special case for small inputs: if input == 8 bytes just use ECB
+      * (see RFC 3394 Section 2)
+      */
+      std::vector<uint8_t> block(16);
+      store_be(ICV, block.data());
+      copy_mem(block.data() + 8, input, input_len);
+      bc.encrypt(block);
+      return block;
+      }
+   else
+      {
+      return raw_nist_key_wrap(input, input_len, bc, ICV);
+      }
    }
 
 secure_vector<uint8_t>
@@ -120,11 +137,26 @@ nist_key_unwrap(const uint8_t input[],
    if(input_len < 16 || input_len % 8 != 0)
       throw Invalid_Argument("Bad input size for NIST key unwrap");
 
+   const uint64_t ICV = 0xA6A6A6A6A6A6A6A6;
+
    uint64_t ICV_out = 0;
+   secure_vector<uint8_t> R;
 
-   secure_vector<uint8_t> R = raw_nist_key_unwrap(input, input_len, bc, ICV_out);
+   if(input_len == 16)
+      {
+      secure_vector<uint8_t> block(input, input + input_len);
+      bc.decrypt(block);
+
+      ICV_out = load_be<uint64_t>(block.data(), 0);
+      R.resize(8);
+      copy_mem(R.data(), block.data() + 8, 8);
+      }
+   else
+      {
+      R = raw_nist_key_unwrap(input, input_len, bc, ICV_out);
+      }
 
-   if(ICV_out != 0xA6A6A6A6A6A6A6A6)
+   if(ICV_out != ICV)
       throw Invalid_Authentication_Tag("NIST key unwrap failed");
 
    return R;
@@ -190,7 +222,7 @@ nist_key_unwrap_padded(const uint8_t input[],
 
    const size_t len = (ICV_out & 0xFFFFFFFF);
 
-   if(R.size() < 8 || len > R.size() || len < R.size() - 8)
+   if(R.size() < 8 || len > R.size() || len <= R.size() - 8)
       throw Invalid_Authentication_Tag("NIST key unwrap failed");
 
    const size_t padding = R.size() - len;


Test patch:
diff --git a/src/tests/data/keywrap/nist_key_wrap.vec b/src/tests/data/keywrap/nist_key_wrap.vec
index 20d837dae..bb2f9ea25 100644
--- a/src/tests/data/keywrap/nist_key_wrap.vec
+++ b/src/tests/data/keywrap/nist_key_wrap.vec
@@ -25,6 +25,11 @@ Input = 00112233445566778899AABBCCDDEEFF000102030405060708090A0B0C0D0E0F
 Key = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
 Output = 28C9F404C4B810F4CBCCB35CFB87F8263F5786E2D80ED326CBC7F0E71A99F43BFB988B9B7A02DD21
 
+# From Wycheproof
+Input = 0001020304050607
+Key = 574957151fc2afe0fa3dc7a9a7da6495
+Output = 6f0b501f1f2f59e3ae605aa679ce43a6
+
 [KWP]
 
 # From RFC 5649
Repository: randombit/botan
Pull request #3384 (2023-03-15 12:51:18)

Backport #3336 Support short XTS nonces


Patch:
diff --git a/src/lib/modes/xts/xts.cpp b/src/lib/modes/xts/xts.cpp
index 559584b08..564bbd31d 100644
--- a/src/lib/modes/xts/xts.cpp
+++ b/src/lib/modes/xts/xts.cpp
@@ -58,7 +58,7 @@ size_t XTS_Mode::default_nonce_length() const
 
 bool XTS_Mode::valid_nonce_length(size_t n) const
    {
-   return cipher_block_size() == n;
+   return n <= cipher_block_size();
    }
 
 void XTS_Mode::key_schedule(const uint8_t key[], size_t length)
@@ -78,6 +78,7 @@ void XTS_Mode::start_msg(const uint8_t nonce[], size_t nonce_len)
       throw Invalid_IV_Length(name(), nonce_len);
 
    m_tweak.resize(update_granularity());
+   clear_mem(m_tweak.data(), m_tweak.size());
    copy_mem(m_tweak.data(), nonce, nonce_len);
    m_tweak_cipher->encrypt(m_tweak.data());
 


Test patch:
diff --git a/src/tests/data/modes/xts.vec b/src/tests/data/modes/xts.vec
index 792e0441a..80c68c654 100644
--- a/src/tests/data/modes/xts.vec
+++ b/src/tests/data/modes/xts.vec
@@ -885,6 +885,11 @@ Nonce = 7F000000000000000000000000000000
 In = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E
 Out = 9D2DAF14E2D62CA1B330D58AAC02BAC80F9E9B49991E618E347269B63614DF04B8C90866EFFC579A721875A4AE108332B9B319E40A742267B003BCB3775650BD204672004A340A5B1227F0D8E61852A88B2FCE8EEB8FC69C2577A71B11331BAB956AB9286741C0C5B7FF162B3ABF16229C9F3EA6DAFA7CA14A23A574703860
 
+# Wycheproof
+Key = 6e9841dd6f35b53c48084f9558deabdebe8a712fd6343046a0f92bfdcfe16e07
+Nonce = 6e08e4314925b6cf
+In = 7252a0545fcaa07fc468c636203de219
+Out = d107e084fbaed19c5be05ac4f48b7732
 
 [AES-256/XTS]
 # From IEEE 1619-2007