As identified in: Qian Guo, Thomas Johansson, Alexander Nilsson. A
key-recovery timing attack on post-quantum primitives using the
Fujisaki-Okamoto transformation and its application on FrodoKEM. In
CRYPTO 2020.
Based on
155c24c3df
* Sebastian's HQC merge request
* Clean up changes to common infrastructure
* Fix Bitmask macro
It assumed that ``unsigned long`` was 64 bit
* Remove maxlen from nistseedexpander
It's a complicated thing to handle because the value is larger than size_t supports on 32-bit platforms
* Initialize buffers to help linter
* Add Nistseedexpander test
* Resolve UB in gf2x.c
Some of the shifts could be larger than WORD_SIZE_BITS, ie. larger than
the width of uint64_t. This apparently on Intel gets interpreted as the
shift mod 64, but on ARM something else happened.
* Fix Windows complaints
* rename log, exp which appear to be existing functions on MS
* Solve endianness problems
* remove all spaces before ';'
* Fix duplicate consistency
* Fix duplicate consistency
* Fix complaints by MSVC about narrowing int
* Add nistseedexpander.obj to COMMON_OBJECTS_NOPATH
* astyle format util.[ch]
* add util.h to makefile
* Sort includes in util.h
* Fix more Windows MSVC complaints
Co-authored-by: Sebastian Verschoor <sebastian@zeroknowledge.me>
Co-authored-by: Thom Wiggers <thom@thomwiggers.nl>
https://github.com/mupq/pqm4/issues/132 repoorted that the NewHope verify function does not actually return 0 or 1, but 0 or -1, which consequenctly breaks the cmov in the FO transform.
This bug was introduced when I integrated this into PQClean.
* Put AES ctx on the heap
This forces people to use the ``ctx_release`` functions, because otherwise there will be leaks
* Put fips202 on the heap
* Add much more docs for fips202.h
* fixup! Put fips202 on the heap
* Put SHA2 on the heap-supporting API
* Fix clang-tidy warnings
* Fix unreachable free() in falcon
* Fix McEliece8192128f-sse GNU Makefile
