ml-dsa: fix constant time issues (#1386)

* ml-dsa: make coeff_from_half_byte constant-time

Algorithm 15 (CoeffFromHalfByte) is called during ExpandS in key generation to sample the secret signing key vectors s1 and s2 from rho'.

Rejection sampling inherently leaks accept/reject decisions, but data-dependent branches within the accepted range leak secret coefficient values via branch timing and predictor state. Using ctutils ensures coefficient reduction and sign selection are branch-free.

* ml-dsa: make Polynomial and Vector infinity_norm branchless

Polynomial::infinity_norm and Vector::infinity_norm are called during the signing loop to check rejection bounds on secret-derived vectors.

Replacing Iterator::max() with a constant-time fold reduction via ctutils eliminates data-dependent comparison branches.

Author: lukaszobernig

ml-dsa/src/algebra.rs

@@ -186,8 +186,7 @@ impl AlgebraExt for Polynomial {
         self.0
             .iter()
             .map(AlgebraExt::infinity_norm)
-            .max()
-            .expect("should have a maximum")
+            .fold(0, |acc, x| u32::ct_select(&x, &acc, acc.ct_gt(&x)))
     }
 
     fn power2round(&self) -> (Self, Self) {
@@ -229,8 +228,7 @@ impl<K: ArraySize> AlgebraExt for Vector<K> {
         self.0
             .iter()
             .map(AlgebraExt::infinity_norm)
-            .max()
-            .expect("should have a maximum")
+            .fold(0, |acc, x| u32::ct_select(&x, &acc, acc.ct_gt(&x)))
     }
 
     fn power2round(&self) -> (Self, Self) {

ml-dsa/src/sampling.rs

@@ -3,6 +3,7 @@ use crate::{
     crypto::{G, H},
     param::{Eta, MaskSamplingSize},
 };
+use ctutils::{CtLt, CtSelect};
 use hybrid_array::Array;
 use module_lattice::{ArraySize, Field, Truncate};
 #[cfg(feature = "zeroize")]
@@ -31,26 +32,11 @@ fn coeff_from_three_bytes(b: [u8; 3]) -> Option<Elem> {
 fn coeff_from_half_byte(b: u8, eta: Eta) -> Option<Elem> {
     match eta {
         Eta::Two if b < 15 => {
-            let b = Int::from(match b {
-                b if b < 5 => b,
-                b if b < 10 => b - 5,
-                _ => b - 10,
-            });
-
-            if b <= 2 {
-                Some(Elem::new(2 - b))
-            } else {
-                Some(-Elem::new(b - 2))
-            }
-        }
-        Eta::Four if b < 9 => {
             let b = Int::from(b);
-            if b <= 4 {
-                Some(Elem::new(4 - b))
-            } else {
-                Some(-Elem::new(b - 4))
-            }
+            let sub = Int::ct_select(&10, &Int::ct_select(&5, &0, b.ct_lt(&5)), b.ct_lt(&10));
+            Some(Elem::new(2) - Elem::new(b - sub))
         }
+        Eta::Four if b < 9 => Some(Elem::new(4) - Elem::new(b.into())),
         _ => None,
     }
 }