linux-kernel - Re: NIST FIPS test vector failures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260119185125.GA11957@sol>
Date: Mon, 19 Jan 2026 10:51:25 -0800
From: Eric Biggers <ebiggers@...nel.org>
To: David Howells <dhowells@...hat.com>
Cc: linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
	Ard Biesheuvel <ardb@...nel.org>,
	"Jason A . Donenfeld" <Jason@...c4.com>,
	Herbert Xu <herbert@...dor.apana.org.au>
Subject: Re: NIST FIPS test vector failures

On Mon, Jan 19, 2026 at 04:48:31PM +0000, David Howells wrote:
> Hi Eric,
> 
> I'm trying out autogenerating X.509 and PKCS#7 tests from the NIST FIPS test
> vectors here:
> 
> https://github.com/usnistgov/ACVP-Server/tree/master/gen-val/json-files/ML-DSA-sigVer-FIPS204
> 
> Unfortunately, all of them seem to fail, but I'm not sure why.  As far as I
> can tell, test case (tcId) 174, for example, should pass, but does not.
> Attached is a patch that adds that test case to the kunit test for ML-DSA for
> you to try, skipping the X509/PKCS7 stuff and going direct to verification.
> Could you have a look see if I've done anything obviously incorrect?

Have you checked which algorithm test case 174 is meant to test?  It's
in the following test group:

    {
      "tgId": 12,
      "testType": "AFT",
      "parameterSet": "ML-DSA-87",
      "signatureInterface": "internal",
      "externalMu": false,
      "tests": [

Given the "signatureInterface": "internal", it seems it's meant to test
ML-DSA.Verify_internal().  Currently, the kernel ML-DSA code only
supports the "external" interface, i.e. ML-DSA.Verify().  So that test
case isn't applicable to it.

- Eric