Skip to content

Add signing hooks for observing signature attempts and implementing restartable signing #1237

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hanno-becker wants to merge 12 commits into
base: main
Choose a base branch
from
Open

Add signing hooks for observing signature attempts and implementing restartable signing #1237

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
3fbd22d
refactor: Introduce MLD_MAX_KAPPA and use it consistently
hanno-becker Jul 1, 2026
25642be
refactor: Add MLD_CONTEXT_UNUSED helper for unused context parameters
hanno-becker Jul 1, 2026
2966365
sign: Make MLD_MAX_SIGNING_ATTEMPTS the effective attempt bound
hanno-becker Jul 1, 2026
a03d00c
sign: Add configurable signing hooks (resume/attempt/finish)
hanno-becker Jul 1, 2026
b3829eb
doc: Expand MLD_CONFIG_CONTEXT_PARAMETER documentation
hanno-becker Jul 1, 2026
ddf18b9
proofs: Add CBMC harnesses for the signing hooks
hanno-becker Jul 1, 2026
3ab4456
test: Add test_sign_hook exercising the signing hooks
hanno-becker Jul 1, 2026
52059aa
autogen: Regenerate configs for the signing hooks
hanno-becker Jul 1, 2026
0803e17
Examples: Add example for restartable signing via signing hooks
hanno-becker Jul 2, 2026
229a0bc
WIP
hanno-becker Jul 11, 2026
b0e99e0
[TEMP] trim down CI
hanno-becker Jul 11, 2026
b43f41e
WIP
hanno-becker Jul 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 23 additions & 2 deletions .github/actions/config-variations/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,9 +33,12 @@ runs:
func: true
kat: true
acvp: true
sign_hook: false # SIGN_HOOK_RESUME is incompatible with KEYGEN_PCT
opt: ${{ inputs.opt }}
examples: true
extra_args: "--exclude-example basic_deterministic"
# basic_deterministic and restartable_sign set MLD_CONFIG_NO_RANDOMIZED_API,
# which is incompatible with MLD_CONFIG_KEYGEN_PCT.
extra_args: "--exclude-example basic_deterministic --exclude-example restartable_sign"
- name: "REDUCE_RAM"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'reduce-ram') }}
uses: ./.github/actions/multi-functest
Expand All @@ -62,9 +65,12 @@ runs:
kat: true
acvp: true
alloc: true
sign_hook: false # SIGN_HOOK_RESUME is incompatible with KEYGEN_PCT
opt: ${{ inputs.opt }}
examples: true
extra_args: "--exclude-example basic_deterministic"
# basic_deterministic and restartable_sign set MLD_CONFIG_NO_RANDOMIZED_API,
# which is incompatible with MLD_CONFIG_KEYGEN_PCT.
extra_args: "--exclude-example basic_deterministic --exclude-example restartable_sign"
- name: "PCT enabled + broken"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'pct-enabled-broken') }}
shell: bash
Expand Down Expand Up @@ -107,6 +113,7 @@ runs:
extra_env: 'ASAN_OPTIONS=detect_leaks=1'
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "Custom zeroization (explicit_bzero)"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'custom-zeroize') }}
Expand All @@ -122,6 +129,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "Custom native capability functions (static ON)"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'native-cap-ON') }}
Expand All @@ -137,6 +145,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "Custom native capability functions (static OFF)"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'native-cap-OFF') }}
Expand All @@ -152,6 +161,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "Custom native capability functions (ID_AA64PFR1_EL1 detection)"
if: ${{ (inputs.tests == 'all' || contains(inputs.tests, 'native-cap-ID_AA64PFR1_EL1')) && runner.os == 'Linux' && runner.arch == 'ARM64' }}
Expand All @@ -167,6 +177,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "Custom native capability functions (CPUID AVX2 detection)"
if: ${{ (inputs.tests == 'all' || contains(inputs.tests, 'native-cap-CPUID_AVX2')) && runner.os == 'Linux' && runner.arch == 'X64' }}
Expand All @@ -182,6 +193,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "No ASM"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'no-asm') }}
Expand All @@ -197,6 +209,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "Serial FIPS202 (no batched Keccak)"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'serial-fips202') }}
Expand All @@ -212,6 +225,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "Custom randombytes"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'custom-randombytes') }}
Expand All @@ -227,6 +241,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: false # Uses its own randombytes implementation
- name: "Custom memcpy"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'custom-memcpy') }}
Expand All @@ -242,6 +257,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "Custom memset"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'custom-memset') }}
Expand All @@ -257,6 +273,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "Custom stdlib (memcpy + memset)"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'custom-stdlib') }}
Expand All @@ -272,6 +289,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "MLD_POLY_UNIFORM_NBLOCKS=1"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'nblocks-1') }}
Expand All @@ -287,6 +305,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "MLD_POLY_UNIFORM_NBLOCKS=4"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'nblocks-4') }}
Expand All @@ -302,6 +321,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "MLD_POLY_UNIFORM_NBLOCKS=6"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'nblocks-6') }}
Expand All @@ -317,6 +337,7 @@ runs:
opt: ${{ inputs.opt }}
examples: false # Some examples use a custom config themselves
alloc: false # Requires custom config
sign_hook: false # Requires custom config
rng_fail: true
- name: "Keygen-only API"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'keygen-only') }}
Expand Down
8 changes: 6 additions & 2 deletions .github/actions/functest/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,9 @@ inputs:
alloc:
description: Determine whether to run alloc tests or not
default: "true"
sign_hook:
description: Determine whether to run sign hook tests or not
default: "true"
rng_fail:
description: Determine whether to run rng fail tests or not
default: "true"
Expand All @@ -88,6 +91,7 @@ runs:
echo EXAMPLES="${{ inputs.examples == 'true' && 'examples' || 'no-examples' }}" >> $GITHUB_ENV
echo STACK="${{ inputs.stack == 'true' && 'stack' || 'no-stack' }}" >> $GITHUB_ENV
echo ALLOC="${{ inputs.alloc == 'true' && 'alloc' || 'no-alloc' }}" >> $GITHUB_ENV
echo SIGN_HOOK="${{ inputs.sign_hook == 'true' && 'sign-hook' || 'no-sign-hook' }}" >> $GITHUB_ENV
echo RNGFAIL="${{ inputs.rng_fail == 'true' && 'rng-fail' || 'no-rng-fail' }}" >> $GITHUB_ENV
- name: Setup nix
uses: ./.github/actions/setup-shell
Expand Down Expand Up @@ -119,13 +123,13 @@ runs:
- $(python3 --version)
- $(${{ inputs.cross_prefix }}${CC} --version | grep -m1 "")
EOF
- name: ${{ env.MODE }} ${{ inputs.opt }} tests (${{ env.FUNC }}, ${{ env.KAT }}, ${{ env.EXAMPLES }}, ${{ env.STACK }}, ${{ env.UNIT }}, ${{ env.ALLOC }}, ${{ env.RNGFAIL }})
- name: ${{ env.MODE }} ${{ inputs.opt }} tests (${{ env.FUNC }}, ${{ env.KAT }}, ${{ env.EXAMPLES }}, ${{ env.STACK }}, ${{ env.UNIT }}, ${{ env.ALLOC }}, ${{ env.SIGN_HOOK }}, ${{ env.RNGFAIL }})
shell: ${{ env.SHELL }}
env:
GH_TOKEN: ${{ inputs.gh_token }}
run: |
make clean
${{ inputs.extra_env }} ./scripts/tests all ${{ inputs.check_namespace == 'true' && '--check-namespace' || ''}} --exec-wrapper="${{ inputs.exec_wrapper }}" --cross-prefix="${{ inputs.cross_prefix }}" --cflags="${{ inputs.cflags }}" --ldflags="${{ inputs.ldflags }}" --opt=${{ inputs.opt }} --${{ env.FUNC }} --${{ env.KAT }} --${{ env.ACVP }} --${{ env.WYCHEPROOF }} --${{ env.EXAMPLES }} --${{ env.STACK }} --${{ env.UNIT }} --${{ env.ALLOC }} --${{ env.RNGFAIL }} -v ${{ inputs.extra_args }}
${{ inputs.extra_env }} ./scripts/tests all ${{ inputs.check_namespace == 'true' && '--check-namespace' || ''}} --exec-wrapper="${{ inputs.exec_wrapper }}" --cross-prefix="${{ inputs.cross_prefix }}" --cflags="${{ inputs.cflags }}" --ldflags="${{ inputs.ldflags }}" --opt=${{ inputs.opt }} --${{ env.FUNC }} --${{ env.KAT }} --${{ env.ACVP }} --${{ env.WYCHEPROOF }} --${{ env.EXAMPLES }} --${{ env.STACK }} --${{ env.UNIT }} --${{ env.ALLOC }} --${{ env.SIGN_HOOK }} --${{ env.RNGFAIL }} -v ${{ inputs.extra_args }}
- name: Post ${{ env.MODE }} Tests
shell: ${{ env.SHELL }}
if: success() || failure()
Expand Down
10 changes: 10 additions & 0 deletions .github/actions/multi-functest/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,9 @@ inputs:
alloc:
description: Determine whether to run alloc tests or not
default: "true"
sign_hook:
description: Determine whether to run sign hook tests or not
default: "true"
rng_fail:
description: Determine whether to run rng fail tests or not
default: "true"
Expand Down Expand Up @@ -96,6 +99,7 @@ runs:
check_namespace: ${{ inputs.check_namespace }}
stack: ${{ inputs.stack }}
alloc: ${{ inputs.alloc }}
sign_hook: ${{ inputs.sign_hook }}
rng_fail: ${{ inputs.rng_fail }}
extra_args: ${{ inputs.extra_args }}
extra_env: ${{ inputs.extra_env }}
Expand All @@ -122,6 +126,7 @@ runs:
check_namespace: ${{ inputs.check_namespace }}
stack: ${{ inputs.stack }}
alloc: ${{ inputs.alloc }}
sign_hook: ${{ inputs.sign_hook }}
rng_fail: ${{ inputs.rng_fail }}
extra_args: ${{ inputs.extra_args }}
extra_env: ${{ inputs.extra_env }}
Expand All @@ -148,6 +153,7 @@ runs:
check_namespace: ${{ inputs.check_namespace }}
stack: ${{ inputs.stack }}
alloc: ${{ inputs.alloc }}
sign_hook: ${{ inputs.sign_hook }}
rng_fail: ${{ inputs.rng_fail }}
extra_args: ${{ inputs.extra_args }}
extra_env: ${{ inputs.extra_env }}
Expand All @@ -174,6 +180,7 @@ runs:
check_namespace: ${{ inputs.check_namespace }}
stack: ${{ inputs.stack }}
alloc: ${{ inputs.alloc }}
sign_hook: ${{ inputs.sign_hook }}
rng_fail: ${{ inputs.rng_fail }}
extra_args: ${{ inputs.extra_args }}
extra_env: ${{ inputs.extra_env }}
Expand All @@ -200,6 +207,7 @@ runs:
check_namespace: ${{ inputs.check_namespace }}
stack: ${{ inputs.stack }}
alloc: ${{ inputs.alloc }}
sign_hook: ${{ inputs.sign_hook }}
rng_fail: ${{ inputs.rng_fail }}
extra_args: ${{ inputs.extra_args }}
extra_env: ${{ inputs.extra_env }}
Expand All @@ -226,6 +234,7 @@ runs:
check_namespace: ${{ inputs.check_namespace }}
stack: ${{ inputs.stack }}
alloc: ${{ inputs.alloc }}
sign_hook: ${{ inputs.sign_hook }}
rng_fail: ${{ inputs.rng_fail }}
extra_args: ${{ inputs.extra_args }}
extra_env: ${{ inputs.extra_env }}
Expand All @@ -252,6 +261,7 @@ runs:
check_namespace: ${{ inputs.check_namespace }}
stack: ${{ inputs.stack }}
alloc: ${{ inputs.alloc }}
sign_hook: ${{ inputs.sign_hook }}
rng_fail: ${{ inputs.rng_fail }}
extra_args: ${{ inputs.extra_args }}
extra_env: ${{ inputs.extra_env }}
Expand Down
Loading
Loading