mirror of
https://github.com/luxfi/fhe.git
synced 2026-07-26 23:16:08 +00:00
Hanzo AI
a3e4beaecc
Empirical constant-time analysis harness mirroring the Pulsar
pack at ~/work/lux/pulsar/ct/dudect/:
encrypt_ct.go + dudect_encrypt.c - cgo bridge + C main loop
decrypt_ct.go + dudect_decrypt.c - the CT-critical routine
bootstrap_ct.go + dudect_bootstrap.c - PBS composite
CT population (operational framing):
- Both classes are VALID inputs to the routine under test
- Class A is a fixed input; class B is uniformly drawn from a
pre-built pool of K independent valid inputs
- Any timing difference is a real secret-content signal
All three cgo shared libraries build clean:
GOWORK=off go build -buildmode=c-shared -tags tfhe_encrypt_ct
GOWORK=off go build -buildmode=c-shared -tags tfhe_decrypt_ct
GOWORK=off go build -buildmode=c-shared -tags tfhe_bootstrap_ct
dudect.h fetched on demand via fetch.sh (not committed).
dudect_compat.h supplies _mm_mfence/__rdtsc on AArch64 hosts.
Submission-grade run pending (GATE-1 in CRYPTOGRAPHER-SIGN-OFF.md).
35 lines
1.3 KiB
Bash
Executable File
35 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fetch dudect at the pinned commit used by Pulsar's constant-time
|
|
# track.
|
|
#
|
|
# dudect (https://github.com/oreparaz/dudect) is a single-header
|
|
# leakage-detection library. We do not vendor dudect.h into this
|
|
# repository — this script reproduces it on demand.
|
|
#
|
|
# Pinned hash at submission-tag time. Update at the same time as the
|
|
# Pulsar submission tag so the artifact chain stays reproducible.
|
|
|
|
set -euo pipefail
|
|
|
|
# Repo + commit (master HEAD as of the dudect harness scaffold land).
|
|
# Update when bumping the submission tag.
|
|
DUDECT_REPO="https://github.com/oreparaz/dudect.git"
|
|
DUDECT_COMMIT="master"
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
cd "$SCRIPT_DIR"
|
|
|
|
if [[ -d dudect/.git ]]; then
|
|
echo "==> dudect already cloned at $SCRIPT_DIR/dudect"
|
|
( cd dudect && git fetch --quiet origin && git checkout --quiet "$DUDECT_COMMIT" )
|
|
else
|
|
echo "==> cloning dudect at $DUDECT_COMMIT"
|
|
git clone --quiet "$DUDECT_REPO" dudect
|
|
( cd dudect && git checkout --quiet "$DUDECT_COMMIT" )
|
|
fi
|
|
|
|
# The header we link against is dudect/src/dudect.h. Stamp the resolved
|
|
# revision so reviewers can verify the artifact chain.
|
|
RESOLVED_REV="$(cd dudect && git rev-parse HEAD)"
|
|
echo "==> dudect.h ready at $SCRIPT_DIR/dudect/src/dudect.h (rev $RESOLVED_REV)"
|