From bb42388827a9b4533f6cdbe8cbefca99505ad1d8 Mon Sep 17 00:00:00 2001
From: Al-Kindi-0 <82364884+Al-Kindi-0@users.noreply.github.com>
Date: Sun, 21 Apr 2024 09:48:40 +0200
Subject: [PATCH] fix: bug in Falcon secret key basis order (#305)

---
 src/dsa/rpo_falcon512/keys/mod.rs        | 3 ++-
 src/dsa/rpo_falcon512/keys/secret_key.rs | 8 ++++----
 src/dsa/rpo_falcon512/math/mod.rs        | 4 ++--
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/dsa/rpo_falcon512/keys/mod.rs b/src/dsa/rpo_falcon512/keys/mod.rs
index 240ff6a3..d29af1c8 100644
--- a/src/dsa/rpo_falcon512/keys/mod.rs
+++ b/src/dsa/rpo_falcon512/keys/mod.rs
@@ -33,7 +33,8 @@ mod tests {
         // test secret key serialization/deserialization
         let mut buffer = vec![];
         sk.write_into(&mut buffer);
-        let sk = SecretKey::read_from_bytes(&buffer).unwrap();
+        let sk_deserialized = SecretKey::read_from_bytes(&buffer).unwrap();
+        assert_eq!(sk.short_lattice_basis(), sk_deserialized.short_lattice_basis());
 
         // sign a random message
         let message: Word = [ONE; 4];
diff --git a/src/dsa/rpo_falcon512/keys/secret_key.rs b/src/dsa/rpo_falcon512/keys/secret_key.rs
index 4a099ff2..d3ca339c 100644
--- a/src/dsa/rpo_falcon512/keys/secret_key.rs
+++ b/src/dsa/rpo_falcon512/keys/secret_key.rs
@@ -210,14 +210,14 @@ impl Serializable for SecretKey {
         let l = n.checked_ilog2().unwrap() as u8;
         let header: u8 = (5 << 4) | l;
 
-        let f = &basis[1];
+        let neg_f = &basis[1];
         let g = &basis[0];
-        let capital_f = &basis[3];
+        let neg_big_f = &basis[3];
 
         let mut buffer = Vec::with_capacity(1281);
         buffer.push(header);
 
-        let f_i8: Vec<i8> = f.coefficients.iter().map(|&a| -a as i8).collect();
+        let f_i8: Vec<i8> = neg_f.coefficients.iter().map(|&a| -a as i8).collect();
         let f_i8_encoded = encode_i8(&f_i8, WIDTH_SMALL_POLY_COEFFICIENT).unwrap();
         buffer.extend_from_slice(&f_i8_encoded);
 
@@ -225,7 +225,7 @@ impl Serializable for SecretKey {
         let g_i8_encoded = encode_i8(&g_i8, WIDTH_SMALL_POLY_COEFFICIENT).unwrap();
         buffer.extend_from_slice(&g_i8_encoded);
 
-        let big_f_i8: Vec<i8> = capital_f.coefficients.iter().map(|&a| -a as i8).collect();
+        let big_f_i8: Vec<i8> = neg_big_f.coefficients.iter().map(|&a| -a as i8).collect();
         let big_f_i8_encoded = encode_i8(&big_f_i8, WIDTH_BIG_POLY_COEFFICIENT).unwrap();
         buffer.extend_from_slice(&big_f_i8_encoded);
         target.write_bytes(&buffer);
diff --git a/src/dsa/rpo_falcon512/math/mod.rs b/src/dsa/rpo_falcon512/math/mod.rs
index 8d0ed17f..6e2e6f06 100644
--- a/src/dsa/rpo_falcon512/math/mod.rs
+++ b/src/dsa/rpo_falcon512/math/mod.rs
@@ -96,10 +96,10 @@ pub(crate) fn ntru_gen<R: Rng>(n: usize, rng: &mut R) -> [Polynomial<i16>; 4] {
             ntru_solve(&f.map(|&i| i.into()), &g.map(|&i| i.into()))
         {
             return [
-                f,
                 g,
-                capital_f.map(|i| i.try_into().unwrap()),
+                -f,
                 capital_g.map(|i| i.try_into().unwrap()),
+                -capital_f.map(|i| i.try_into().unwrap()),
             ];
         }
     }