Constant-time review › kex-09 · Report

TriQ-KEX constant-time review

Scope: four submitted reference variants. The code paths below were traced in TriQ-KEX-128; src/ref/vector.c, parsing.c, and triq_pke.c are byte-identical across 128/256/384/512. This is a source-level review of the cited paths, not a machine-code proof of all functions or platforms.

Secrets: the long-term KEM decryption seed, PRF keys, ephemeral KEM messages/coins, and derived session key. Public values: transmitted identities, public keys, ciphertexts and their lengths. A validity predicate after secret-key decapsulation is not automatically public merely because the ciphertext is public.

• Confirmed leak (kex-09-1): src/common/kem.c:156 decrypts with the secret dk_pke; src/ref/triq_pke.c:140-144 expands it; src/ref/parsing.c:19-22 seeds the XOF with it; src/ref/vector.c:69-90 has secret-derived rejection, duplicate-test and variable draw count. The sampler is called again for every decapsulation. reproduce_ct_sampler.c observes different XOF fetch counts on two fixed secret seeds. The implementation comment at vector.c:164 claiming this sampler is only used in key generation is false for this path.
• Fixed-time controls in the inspected core: src/common/kem.c:166-174 combines decapsulation comparison flags into a mask and selects the real/rejection key without branching; src/ref/vector.c:135-155 writes a secret support set with a full fixed-index scan rather than indexing v directly; src/ref/gf.c:108-135 uses fixed loops for GF multiplication. These do not undo the secret-dependent sampler above.
• Other variable paths: src/ref/vector.c:249-253 has bounded-density retry when sampling encryption randomness. It also runs during decapsulation re-encryption (src/common/kem.c:156-164 → src/ref/triq_pke.c:96-98), with coins derived from the secret-key-recovered message, not only during public encapsulation. The Guo et al. HQC/BIKE attack makes this a follow-up key-recovery lead, but its specific oracle has not been shown for TriQ-KEX. Length and allocation checks in src/common/symmetric.c:15-40 depend on public/parameter lengths or resource state, not demonstrated secret values.

Coverage limit: this audit traced the KEM/key-exchange call graph and searched branch, table-index and division/remainder sites in representative reference sources. It did not prove every auxiliary implementation or compiler output constant-time.