Skip to content

SDitH Integration #2586

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
owaldron wants to merge 14 commits into
base: main
Choose a base branch
from
+39,068 −24
Open

SDitH Integration #2586

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
0c47410
Add AES rekey function for AES128 ECB
owaldron Oct 6, 2026
b5a1bae
Support nested common dependencies in copy_from_upstream.
owaldron Oct 6, 2026
48a22ee
Add SDitH3 signature family via copy_from_upstream.
owaldron Oct 6, 2026
7d9fb15
Gate SDitH by platform and exempt it from -Werror.
owaldron Oct 6, 2026
f94e3e1
Added constant-time suppressions for SDitH.
owaldron Oct 6, 2026
8f74956
Fix zephyr configuration for SDitH
owaldron Oct 6, 2026
7bbda62
Add SDitH3 algorithm documentation.
owaldron Oct 6, 2026
e197edd
Point SDitH upstream at the non-rekey AES glue
owaldron Oct 19, 2026
300fdff
Revert "Add AES rekey function for AES128 ECB"
owaldron Oct 19, 2026
b8c593d
Switch SDitH3 upstream from fork to patched main.
owaldron Oct 19, 2026
c5d252e
Flatten SDitH commons structure.
owaldron Oct 21, 2026
eb61e0d
Revert "Support nested common dependencies in copy_from_upstream."
owaldron Oct 21, 2026
a3cfb1e
Address PR comments for SDitH
owaldron Oct 21, 2026
14d6f4a
Add missing "all" kat hashes for SDitH
owaldron Oct 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
101 changes: 101 additions & 0 deletions .CMake/alg_support.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,20 @@ cmake_dependent_option(OQS_ENABLE_KEM_bike_l1 "" ON "OQS_ENABLE_KEM_BIKE" OFF)
cmake_dependent_option(OQS_ENABLE_KEM_bike_l3 "" ON "OQS_ENABLE_KEM_BIKE" OFF)
cmake_dependent_option(OQS_ENABLE_KEM_bike_l5 "" ON "OQS_ENABLE_KEM_BIKE" OFF)

# SDitH is not supported on Windows: its reference code uses __uint128_t and GCC/Clang function
# attributes, neither of which MSVC provides.
# SDitH is also not supported on S390X or PPC64 (big endian): the code reinterprets uint64_t and
Comment thread
baentsch marked this conversation as resolved.
# __uint128_t words as byte strings in several places (e.g. the AES-CTR domain separation in
# sdith_prng_private.h and the proof-of-work counter in the signature), so it is little endian only.
# This does not conflict with the later `option(OQS_ENABLE_SIG_SDITH ...)`,
# since `option()` does nothing if the variable is already set as a normal or
# cache variable: https://cmake.org/cmake/help/latest/command/option.html
cmake_dependent_option(OQS_ENABLE_SIG_SDITH "Enable sdith algorithm family" ON "NOT WIN32; NOT ARCH_S390X; NOT ARCH_PPC64" OFF)

@xuganyu96 xuganyu96 Oct 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SDitH is the only copied-from-upstream algorithm family that has platform restrictions, so OQS_ENABLE_SIG_SDITH is the only variable declared with both cmake_dependent_option here and option later at line 282.

Check if line 282 is harmlessly redundant or actually in conflict with the declaration here. A short comment explaining why they are not in conflict or even just a link to cmake documentation would be helpful.

@owaldron owaldron Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've added a comment with a short explanation about thy this is harmless:

# This does not conflict with the later `option(OQS_ENABLE_SIG_SDITH ...)`,
# since `option()` does nothing if the variable is already set as a normal or
# cache variable: https://cmake.org/cmake/help/latest/command/option.html

# SDitH doesn't work on any 32-bit platform: __uint128_t requires 128-bit int support
if(CMAKE_SIZEOF_VOID_P MATCHES "4")
set(OQS_ENABLE_SIG_SDITH OFF)
endif()

option(OQS_ENABLE_KEM_FRODOKEM "Enable Frodo algorithm family" ON)
cmake_dependent_option(OQS_ENABLE_KEM_frodokem_640_aes "" ON "OQS_ENABLE_KEM_FRODOKEM" OFF)
cmake_dependent_option(OQS_ENABLE_KEM_frodokem_640_shake "" ON "OQS_ENABLE_KEM_FRODOKEM" OFF)
Expand Down Expand Up @@ -299,6 +313,20 @@ cmake_dependent_option(OQS_ENABLE_SIG_mqom_mqom3_cat5_gf16_short_ct "" ON "OQS_E
cmake_dependent_option(OQS_ENABLE_SIG_mqom_mqom3_cat5_gf16_short_ot "" ON "OQS_ENABLE_SIG_MQOM" OFF)
cmake_dependent_option(OQS_ENABLE_SIG_mqom_mqom3_cat5_gf2_shorter_ct "" ON "OQS_ENABLE_SIG_MQOM" OFF)
cmake_dependent_option(OQS_ENABLE_SIG_mqom_mqom3_cat5_gf2_shorter_ot "" ON "OQS_ENABLE_SIG_MQOM" OFF)

option(OQS_ENABLE_SIG_SDITH "Enable sdith algorithm family" ON)
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l1_gf2_short "" ON "OQS_ENABLE_SIG_SDITH" OFF)
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l1_gf2_short_cipherpow "" ON "OQS_ENABLE_SIG_SDITH" OFF)
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l1_gf2_fast "" ON "OQS_ENABLE_SIG_SDITH" OFF)
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l1_gf2_fast_cipherpow "" ON "OQS_ENABLE_SIG_SDITH" OFF)
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l3_gf2_short "" ON "OQS_ENABLE_SIG_SDITH" OFF)
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l3_gf2_short_cipherpow "" ON "OQS_ENABLE_SIG_SDITH" OFF)
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l3_gf2_fast "" ON "OQS_ENABLE_SIG_SDITH" OFF)
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l3_gf2_fast_cipherpow "" ON "OQS_ENABLE_SIG_SDITH" OFF)
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l5_gf2_short "" ON "OQS_ENABLE_SIG_SDITH" OFF)
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l5_gf2_short_cipherpow "" ON "OQS_ENABLE_SIG_SDITH" OFF)
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l5_gf2_fast "" ON "OQS_ENABLE_SIG_SDITH" OFF)
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l5_gf2_fast_cipherpow "" ON "OQS_ENABLE_SIG_SDITH" OFF)
##### OQS_COPY_FROM_UPSTREAM_FRAGMENT_ADD_ENABLE_BY_ALG_END
##### OQS_COPY_FROM_SLH_DSA_FRAGMENT_ADD_ENABLE_BY_ALG_START
option(OQS_ENABLE_SIG_SLH_DSA "Enable slh_dsa algorithm family" ON)
Expand Down Expand Up @@ -1786,6 +1814,79 @@ if(OQS_DIST_ARM64_V8_BUILD OR (OQS_USE_ARM_NEON_INSTRUCTIONS AND OQS_USE_ARM_NEO
endif()
endif()


if(CMAKE_SYSTEM_NAME MATCHES "Linux")
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_AVX_INSTRUCTIONS AND OQS_USE_AES_INSTRUCTIONS AND OQS_USE_PCLMULQDQ_INSTRUCTIONS))
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l1_gf2_short_avx2 "" ON "OQS_ENABLE_SIG_sdith_l1_gf2_short" OFF)
endif()
endif()

if(CMAKE_SYSTEM_NAME MATCHES "Linux")
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_AVX_INSTRUCTIONS AND OQS_USE_AES_INSTRUCTIONS AND OQS_USE_PCLMULQDQ_INSTRUCTIONS))
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l1_gf2_short_cipherpow_avx2 "" ON "OQS_ENABLE_SIG_sdith_l1_gf2_short_cipherpow" OFF)
endif()
endif()

if(CMAKE_SYSTEM_NAME MATCHES "Linux")
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_AVX_INSTRUCTIONS AND OQS_USE_AES_INSTRUCTIONS AND OQS_USE_PCLMULQDQ_INSTRUCTIONS))
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l1_gf2_fast_avx2 "" ON "OQS_ENABLE_SIG_sdith_l1_gf2_fast" OFF)
endif()
endif()

if(CMAKE_SYSTEM_NAME MATCHES "Linux")
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_AVX_INSTRUCTIONS AND OQS_USE_AES_INSTRUCTIONS AND OQS_USE_PCLMULQDQ_INSTRUCTIONS))
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l1_gf2_fast_cipherpow_avx2 "" ON "OQS_ENABLE_SIG_sdith_l1_gf2_fast_cipherpow" OFF)
endif()
endif()

if(CMAKE_SYSTEM_NAME MATCHES "Linux")
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_AVX_INSTRUCTIONS AND OQS_USE_AES_INSTRUCTIONS AND OQS_USE_PCLMULQDQ_INSTRUCTIONS))
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l3_gf2_short_avx2 "" ON "OQS_ENABLE_SIG_sdith_l3_gf2_short" OFF)
endif()
endif()

if(CMAKE_SYSTEM_NAME MATCHES "Linux")
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_AVX_INSTRUCTIONS AND OQS_USE_AES_INSTRUCTIONS AND OQS_USE_PCLMULQDQ_INSTRUCTIONS))
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l3_gf2_short_cipherpow_avx2 "" ON "OQS_ENABLE_SIG_sdith_l3_gf2_short_cipherpow" OFF)
endif()
endif()

if(CMAKE_SYSTEM_NAME MATCHES "Linux")
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_AVX_INSTRUCTIONS AND OQS_USE_AES_INSTRUCTIONS AND OQS_USE_PCLMULQDQ_INSTRUCTIONS))
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l3_gf2_fast_avx2 "" ON "OQS_ENABLE_SIG_sdith_l3_gf2_fast" OFF)
endif()
endif()

if(CMAKE_SYSTEM_NAME MATCHES "Linux")
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_AVX_INSTRUCTIONS AND OQS_USE_AES_INSTRUCTIONS AND OQS_USE_PCLMULQDQ_INSTRUCTIONS))
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l3_gf2_fast_cipherpow_avx2 "" ON "OQS_ENABLE_SIG_sdith_l3_gf2_fast_cipherpow" OFF)
endif()
endif()

if(CMAKE_SYSTEM_NAME MATCHES "Linux")
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_AVX_INSTRUCTIONS AND OQS_USE_AES_INSTRUCTIONS AND OQS_USE_PCLMULQDQ_INSTRUCTIONS))
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l5_gf2_short_avx2 "" ON "OQS_ENABLE_SIG_sdith_l5_gf2_short" OFF)
endif()
endif()

if(CMAKE_SYSTEM_NAME MATCHES "Linux")
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_AVX_INSTRUCTIONS AND OQS_USE_AES_INSTRUCTIONS AND OQS_USE_PCLMULQDQ_INSTRUCTIONS))
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l5_gf2_short_cipherpow_avx2 "" ON "OQS_ENABLE_SIG_sdith_l5_gf2_short_cipherpow" OFF)
endif()
endif()

if(CMAKE_SYSTEM_NAME MATCHES "Linux")
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_AVX_INSTRUCTIONS AND OQS_USE_AES_INSTRUCTIONS AND OQS_USE_PCLMULQDQ_INSTRUCTIONS))
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l5_gf2_fast_avx2 "" ON "OQS_ENABLE_SIG_sdith_l5_gf2_fast" OFF)
endif()
endif()

if(CMAKE_SYSTEM_NAME MATCHES "Linux")
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_AVX_INSTRUCTIONS AND OQS_USE_AES_INSTRUCTIONS AND OQS_USE_PCLMULQDQ_INSTRUCTIONS))
cmake_dependent_option(OQS_ENABLE_SIG_sdith_l5_gf2_fast_cipherpow_avx2 "" ON "OQS_ENABLE_SIG_sdith_l5_gf2_fast_cipherpow" OFF)
endif()
endif()

##### OQS_COPY_FROM_UPSTREAM_FRAGMENT_ADD_ENABLE_BY_ALG_CONDITIONAL_END

##### OQS_COPY_FROM_LIBJADE_FRAGMENT_ADD_ENABLE_BY_ALG_CONDITIONAL_START
Expand Down
Loading
Loading