OQS CI: Enable constant-time tests #1200
Conversation
mkannwischer
changed the title
mkannwischer
force-pushed
the
oqs-ct
branch
from
223ca68 to
f238424
Compare
hanno-becker
force-pushed
the
oqs-ct
branch
from
f238424 to
d393cbb
Compare
|
https://github.com/pq-code-package/mlkem-native/actions/runs/18054655007 shows that this does not work as expected - removing a declassification causes |
I looked into it. It turns out that the whitelist in OQS still matches the functions that were tested here. I added that removal to the CI workflow. |
|
@mkannwischer Can you open an issue so we don't forget to remove the patch once the fix has been merged? |
Currently our liboqs integration tests are skipping the oqs constant time tests. There is no reason to skip those. This commit adds -DCMAKE_BUILD_TYPE=Debug -DOQS_ENABLE_TEST_CONSTANT_TIME=ON which enables the constant-time tests. Resolves #1199 Signed-off-by: Matthias J. Kannwischer <matthias@kannwischer.eu>
This commit enables declassifications when constant-time tests are performed in liboqs. It is essential that MLK_CONFIG_CT_TESTING_ENABLED is set BEFORE sys.h is included. With this changed, the constant-time tests pass again in liboqs. The reason that the constant time tests are not failing upstream is that liboqs maintains a whitelist of code locations that are expected to fail constant time testing. In the meantime, we have ranamed checks_sk in a00cc0d which is causing constant-time failures as the whitelist was not updated. The whitelist approach is not robust and we should not rely on it. Signed-off-by: Matthias J. Kannwischer <matthias@kannwischer.eu>
In OQS constant-time testing is done by documenting all known potential constant-time violations that are known to be false positives as "passes". In mlkem-native we take a diffeernt approach and have explicit declassifications in the code. The previous commit enabled the declassifications in the OQS CI. However, as the "passes" are still in OQS upstream, tests would pass even if our declassications would be removed. This commit patches OQS as a part of our CI to remove the constant-time passes. I have tested in CI that this removal will make the constant-time tests fail in case declassifcations are removed. Signed-off-by: Matthias J. Kannwischer <matthias@kannwischer.eu>
- We found this typo during mldsa-native PR#489, fixing it with this commit, see: pq-code-package/mldsa-native#489 (comment) Signed-off-by: willieyz <willie.zhao@chelpis.com>
3 participants
Currently our liboqs integration tests are skipping the oqs constant time tests. There is no reason to skip those.
This commit adds
-DCMAKE_BUILD_TYPE=Debug -DOQS_ENABLE_TEST_CONSTANT_TIME=ON which enables the constant-time tests.