Jussi's comments on Phabricator regarding kyber and kmac patches

[falko-strenzke]

From https://dev.gnupg.org/T6637#177086

Few comments on the patches.

• First, I needed following to patches to make tests run (fixes building & testing outside source tree, and fixes memory leaks): 0001-fix-mlkem-test.patch1 KBDownload #25
  0002-fix-mlkem-memory-leaks.patch907 BDownload
• There's few files missing license text at beginning of file (cipher/consttime.*, tests/test-utils.h).
• // C++ style comment lines are used in few places. These need to be changed to C comments /* ... */
  • kyber branch
  • kmac branch
• cipher/consttime.c:
  • "_gcry_consttime_bytes_differ": there is already "buf_eq_const" in bufhelp.h which does the same. #26
  • WONTFIX "_gcry_consttime_cmov": this could be hardened against nonce@once style attacks. _gcry_mpih_set_cond in mpi/mpih-const-time.c can be used as example for this (uses two masks and AND/OR instead of single mask with XOR). #27
• cipher/mlkem-cbd.c:
  • "load32_littleendian": there is "buf_get_le32" in bufhelp.h for reading 32-bit in little-endian order.
• postponed cipher/tests-utils.h: not sure about this file. Where these functions copied over from other tests sources? Should other tests switch to use tests-utils.h? #28
• benchmarking: postponed (test work package)
• _gcry_md_hash_buffers_extract can be used instead of _gcry_md_open&write&extract&close. #37
• ML-KEM: functions that use buffers on the stack #38
• mlkem.c: mlkem_check_secret_key: "memcmp" is used to compare shared secrets. Should this use constant time comparison instead?
• don't use uintXX_t types #40