ML-DSA unique names (#2072)

### Issues:
As we prepare to move ML-DSA to the FIPS module we encounter many issues
with duplicate definitions due to the similarities between ML-DSA and
ML-KEM (that already exists within the module).

To address this issue we remove these duplicate names, and replace with
more specific naming. This aides with code readability.

### Description of changes: 
Renamed:
- `N` is now `ML_DSA_N`
- `Q` is now `ML_DSA_Q`
- `D` is now `ML_DSA_D`
- `QINV` is now `ML_DSA_QINV`
- `MONT`, `ROOT_OF_UNITY` are never used, so we remove them.
- `DILITHIUM_K_MAX` is now `ML_DSA_K_MAX`
- `DILITHIUM_L_MAX` is now `ML_DSA_L_MAX`
- `DILITHIUM_C_TILDE_BYTES_MAX` is now `ML_DSA_C_TILDE_BYTES_MAX`
- `DILITHIUM_POLYW1_PACKEDBYTES_MAX` is now
`ML_DSA_POLYW1_PACKEDBYTES_MAX`
- `DILITHIUM_POLY_UNIFORM_ETA_NBLOCKS_MAX` is now
`ML_DSA_POLY_UNIFORM_ETA_NBLOCKS_MAX`
- `DILITHIUM_POLYZ_PACKEDBYTES_MAX` is now
`ML_DSA_POLYZ_PACKEDBYTES_MAX`
- `poly_reduce` is now `ml_dsa_poly_reduce`
- `poly_add` is now `ml_dsa_poly_add`
- `poly_sub` is now `ml_dsa_poly_sub`
- `poly_ntt` is now `ml_dsa_poly_ntt`
- `poly_invntt_tomont` is now `ml_dsa_poly_invntt_tomont`
- `crypto_sign_keypair` is now `ml_dsa_keypair`
- `crypto_sign_keypair_internal` is now `ml_dsa_keypair_internal`
- `crypto_sign_signature` is now `ml_dsa_signa`
- `crypto_sign_signature_internal` is now `ml_dsa_sign_internal`
- `crypto_sign` is now `ml_dsa_sign_message`
- `crypto_sign_verify` is now `ml_dsa_verify`
- `crypto_sign_verify_internal` is now `ml_dsa_verify_internal`
- `crypto_sign_open` is now `ml_dsa_verify_message`
- `fqmul` is now `ml_dsa_fqmul`
- `invntt_tomont` is now `ml_dsa_invntt_tomont`
- `pack_pk` is now `ml_dsa_pack_pk`
- `unpack_pk` is now `ml_dsa_unpack_pk`
- `pack_sk` is now `ml_dsa_pack_sk`
- `unpack_sk` is now `ml_dsa_unpack_sk`
- `polyeta_pack` is now `ml_dsa_polyeta_pack`
- `polyeta_unpack` is now `ml_dsa_polyeta_unpack`
- `polyt0_pack` is now `ml_dsa_polyt0_pack`
- `polyt0_unpack` is now `ml_dsa_polyt0_unpack`
- `pack_sig` is now `ml_dsa_pack_sig`
- `unpack_sig` is now `ml_dsa_unpack_sig`
- `polyz_pack` is now `ml_dsa_polyz_pack`
- `polyz_unpack` is now `ml_dsa_polyz_unpack`
- `SEEDBYTES` is now `ML_DSA_SEEDBYTES`
- `TRBYTES` is now `ML_DSA_TRBYTES`
- `POLYT0_PACKEDBYTES` is now `ML_DSA_POLYT0_PACKEDBYTES`
- `POLYT1_PACKEDBYTES` is now `ML_DSA_POLYT1_PACKEDBYTES`
- `RNDBYTES` is now `ML_DSA_RNDBYTES`
- `poly_caddq` is now `ml_dsa_poly_caddq`
- `poly_shiftl` is now `ml_dsa_poly_shiftl`
- `poly_pointwise_montgomery` is now `ml_dsa_poly_pointwise_montgomery`
- `poly_power2round` is now `ml_dsa_poly_power2round`
- `poly_decompose` is now `ml_dsa_poly_decompose`
- `poly_make_hint` is now `ml_dsa_poly_make_hint`
- `poly_use_hint` is now `ml_dsa_poly_use_hint`
- `poly_chknorm` is now `ml_dsa_poly_chknorm`
- `poly_uniform` is now `ml_dsa_poly_uniform`
- `poly_uniform_eta` is now `ml_dsa_poly_uniform_eta`
- `poly_uniform_gamma1` is now `ml_dsa_poly_uniform_gamma1`
- `poly_challenge` is now `ml_dsa_poly_challenge`
- `polyeta_pack` is now `ml_dsa_polyeta_pack`
- `polyeta_unpack` is now `ml_dsa_polyeta_unpack`
- `polyt1_pack` is now `ml_dsa_polyt1_pack`
- `polyt1_unpack` is now `ml_dsa_polyt1_unpack`
- `polyt0_pack` is now `ml_dsa_polyt0_pack`
- `polyt0_unpack` is now `ml_dsa_polyt0_unpack`
- `polyz_pack` is now `ml_dsa_polyz_pack`
- `polyz_unpack` is now `ml_dsa_polyz_unpack`
- `polyw1_pack` is now `ml_dsa_polyw1_pack`
- `polyvecl_uniform_eta` is now `ml_dsa_polyvecl_uniform_eta`
- `polyvecl_uniform_gamma1` is now `ml_dsa_polyvecl_uniform_gamma1`
- `polyvecl_reduce` is now `ml_dsa_polyvecl_reduce`
- `polyvecl_add` is now `ml_dsa_polyvecl_add`
- `polyvecl_ntt` is now `ml_dsa_polyvecl_ntt`
- `polyvecl_invntt_tomont` is now `ml_dsa_polyvecl_invntt_tomont`
- `polyvecl_pointwise_poly_montgomery` is now
`ml_dsa_polyvecl_pointwise_poly_montgomery`
- `polyvecl_pointwise_acc_montgomery` is now
`ml_dsa_polyvecl_pointwise_acc_montgomery`
- `polyvecl_chknorm` is now `ml_dsa_polyvecl_chknorm`
- `polyveck_uniform_eta` is now `ml_dsa_polyveck_uniform_eta`
- `polyveck_reduce` is now `ml_dsa_polyveck_reduce`
- `polyveck_caddq` is now `ml_dsa_polyveck_caddq`
- `polyveck_add` is now `ml_dsa_polyveck_add`
- `polyveck_sub` is now `ml_dsa_polyveck_sub`
- `polyveck_shiftl` is now `ml_dsa_polyveck_shiftl'
- `polyveck_ntt` is now `ml_dsa_polyveck_ntt`
- `polyveck_invntt_tomont` is now `ml_dsa_polyveck_invntt_tomont`
- `polyveck_pointwise_poly_montgomery` is now
`ml_dsa_polyveck_pointwise_poly_montgomery`
- `polyveck_chknorm` is now `ml_dsa_polyveck_chknorm`
- `polyveck_power2round` is now `ml_dsa_polyveck_power2round`
- `polyveck_decompose` is now `ml_dsa_polyveck_decompose`
- `polyveck_make_hint` is now `ml_dsa_polyveck_make_hint`
- `polyveck_use_hint` is now `ml_dsa_polyveck_use_hint`
- `polyveck_pack_w1` is now `ml_dsa_polyveck_pack_w1`
- `polyvec_matrix_expand` is now `ml_dsa_polyvec_matrix_expand`
- `polyvec_matrix_pointwise_montgomery` is now
`ml_dsa_polyvec_matrix_pointwise_montgomery`
- `reduce32` is now `ml_dsa_reduce32`
- `caddq` is now `ml_dsa_caddq`
- `freeze` is now `ml_dsa_freeze`
- `power2round` is now `ml_dsa_power2round`
- `decompose` is now `ml_dsa_decompose`
- `make_hint` is now `ml_dsa_`make_hint
- `use_hint` is now `ml_dsa_use_hint`
- `poly` is now `ml_dsa_poly`
- `rej_uniform` is now `ml_dsa_rej_uniform`

(the `crypto_sign_*` names are an artefact of the NIST PQC submission
requirements, so are replaced with meaningful names)

### Call-outs:
Only changed names where necessary.

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.

crypto/dilithium/ml_dsa.c

@@ -27,15 +27,15 @@ int ml_dsa_44_keypair(uint8_t *public_key   /* OUT */,
                       uint8_t *private_key  /* OUT */) {
   ml_dsa_params params;
   ml_dsa_44_params_init(&params);
-  return (crypto_sign_keypair(&params, public_key, private_key) == 0);
+  return (ml_dsa_keypair(&params, public_key, private_key) == 0);
 }
 
 int ml_dsa_44_keypair_internal(uint8_t *public_key   /* OUT */,
                                uint8_t *private_key  /* OUT */,
                                const uint8_t *seed   /* IN */) {
   ml_dsa_params params;
   ml_dsa_44_params_init(&params);
-  return crypto_sign_keypair_internal(&params, public_key, private_key, seed) == 0;
+  return ml_dsa_keypair_internal(&params, public_key, private_key, seed) == 0;
 }
 
 int ml_dsa_44_sign(const uint8_t *private_key /* IN */,
@@ -47,8 +47,8 @@ int ml_dsa_44_sign(const uint8_t *private_key /* IN */,
                    size_t ctx_string_len      /* IN */) {
   ml_dsa_params params;
   ml_dsa_44_params_init(&params);
-  return crypto_sign_signature(&params, sig, sig_len, message, message_len,
-                               ctx_string, ctx_string_len, private_key) == 0;
+  return ml_dsa_sign(&params, sig, sig_len, message, message_len,
+                     ctx_string, ctx_string_len, private_key) == 0;
 }
 
 int ml_dsa_44_sign_internal(const uint8_t *private_key  /* IN */,
@@ -61,8 +61,8 @@ int ml_dsa_44_sign_internal(const uint8_t *private_key  /* IN */,
                             uint8_t *rnd                /* IN */) {
   ml_dsa_params params;
   ml_dsa_44_params_init(&params);
-  return crypto_sign_signature_internal(&params, sig, sig_len, message, message_len,
-                                        pre, pre_len, rnd, private_key) == 0;
+  return ml_dsa_sign_internal(&params, sig, sig_len, message, message_len,
+                              pre, pre_len, rnd, private_key) == 0;
 }
 
 int ml_dsa_44_verify(const uint8_t *public_key /* IN */,
@@ -74,8 +74,8 @@ int ml_dsa_44_verify(const uint8_t *public_key /* IN */,
                      size_t ctx_string_len     /* IN */) {
   ml_dsa_params params;
   ml_dsa_44_params_init(&params);
-  return crypto_sign_verify(&params, sig, sig_len, message, message_len,
-                            ctx_string, ctx_string_len, public_key) == 0;
+  return ml_dsa_verify(&params, sig, sig_len, message, message_len,
+                       ctx_string, ctx_string_len, public_key) == 0;
 }
 
 int ml_dsa_44_verify_internal(const uint8_t *public_key /* IN */,
@@ -87,23 +87,23 @@ int ml_dsa_44_verify_internal(const uint8_t *public_key /* IN */,
                               size_t pre_len            /* IN */) {
   ml_dsa_params params;
   ml_dsa_44_params_init(&params);
-  return crypto_sign_verify_internal(&params, sig, sig_len, message, message_len,
-                                     pre, pre_len, public_key) == 0;
+  return ml_dsa_verify_internal(&params, sig, sig_len, message, message_len,
+                                pre, pre_len, public_key) == 0;
 }
 
 int ml_dsa_65_keypair(uint8_t *public_key   /* OUT */,
                       uint8_t *private_key  /* OUT */) {
   ml_dsa_params params;
   ml_dsa_65_params_init(&params);
-  return (crypto_sign_keypair(&params, public_key, private_key) == 0);
+  return (ml_dsa_keypair(&params, public_key, private_key) == 0);
 }
 
 int ml_dsa_65_keypair_internal(uint8_t *public_key   /* OUT */,
                                uint8_t *private_key  /* OUT */,
                                const uint8_t *seed   /* IN */) {
   ml_dsa_params params;
   ml_dsa_65_params_init(&params);
-  return crypto_sign_keypair_internal(&params, public_key, private_key, seed) == 0;
+  return ml_dsa_keypair_internal(&params, public_key, private_key, seed) == 0;
 }
 
 int ml_dsa_65_sign(const uint8_t *private_key /* IN */,
@@ -115,8 +115,8 @@ int ml_dsa_65_sign(const uint8_t *private_key /* IN */,
                    size_t ctx_string_len      /* IN */) {
   ml_dsa_params params;
   ml_dsa_65_params_init(&params);
-  return crypto_sign_signature(&params, sig, sig_len, message, message_len,
-                               ctx_string, ctx_string_len, private_key) == 0;
+  return ml_dsa_sign(&params, sig, sig_len, message, message_len,
+                     ctx_string, ctx_string_len, private_key) == 0;
 }
 
 int ml_dsa_65_sign_internal(const uint8_t *private_key  /* IN */,
@@ -129,8 +129,8 @@ int ml_dsa_65_sign_internal(const uint8_t *private_key  /* IN */,
                             uint8_t *rnd                /* IN */) {
   ml_dsa_params params;
   ml_dsa_65_params_init(&params);
-  return crypto_sign_signature_internal(&params, sig, sig_len, message, message_len,
-                                        pre, pre_len, rnd, private_key) == 0;
+  return ml_dsa_sign_internal(&params, sig, sig_len, message, message_len,
+                              pre, pre_len, rnd, private_key) == 0;
 }
 
 int ml_dsa_65_verify(const uint8_t *public_key /* IN */,
@@ -142,8 +142,8 @@ int ml_dsa_65_verify(const uint8_t *public_key /* IN */,
                      size_t ctx_string_len     /* IN */) {
   ml_dsa_params params;
   ml_dsa_65_params_init(&params);
-  return crypto_sign_verify(&params, sig, sig_len, message, message_len,
-                            ctx_string, ctx_string_len, public_key) == 0;
+  return ml_dsa_verify(&params, sig, sig_len, message, message_len,
+                       ctx_string, ctx_string_len, public_key) == 0;
 }
 
 int ml_dsa_65_verify_internal(const uint8_t *public_key /* IN */,
@@ -155,23 +155,23 @@ int ml_dsa_65_verify_internal(const uint8_t *public_key /* IN */,
                               size_t pre_len            /* IN */) {
   ml_dsa_params params;
   ml_dsa_65_params_init(&params);
-  return crypto_sign_verify_internal(&params, sig, sig_len, message, message_len,
-                                     pre, pre_len, public_key) == 0;
+  return ml_dsa_verify_internal(&params, sig, sig_len, message, message_len,
+                                pre, pre_len, public_key) == 0;
 }
 
 int ml_dsa_87_keypair(uint8_t *public_key   /* OUT */,
                       uint8_t *private_key  /* OUT */) {
   ml_dsa_params params;
   ml_dsa_87_params_init(&params);
-  return (crypto_sign_keypair(&params, public_key, private_key) == 0);
+  return (ml_dsa_keypair(&params, public_key, private_key) == 0);
 }
 
 int ml_dsa_87_keypair_internal(uint8_t *public_key   /* OUT */,
                                uint8_t *private_key  /* OUT */,
                                const uint8_t *seed   /* IN */) {
   ml_dsa_params params;
   ml_dsa_87_params_init(&params);
-  return crypto_sign_keypair_internal(&params, public_key, private_key, seed) == 0;
+  return ml_dsa_keypair_internal(&params, public_key, private_key, seed) == 0;
 }
 
 int ml_dsa_87_sign(const uint8_t *private_key /* IN */,
@@ -183,8 +183,8 @@ int ml_dsa_87_sign(const uint8_t *private_key /* IN */,
                    size_t ctx_string_len      /* IN */) {
   ml_dsa_params params;
   ml_dsa_87_params_init(&params);
-  return crypto_sign_signature(&params, sig, sig_len, message, message_len,
-                               ctx_string, ctx_string_len, private_key) == 0;
+  return ml_dsa_sign(&params, sig, sig_len, message, message_len,
+                     ctx_string, ctx_string_len, private_key) == 0;
 }
 
 int ml_dsa_87_sign_internal(const uint8_t *private_key  /* IN */,
@@ -197,8 +197,8 @@ int ml_dsa_87_sign_internal(const uint8_t *private_key  /* IN */,
                             uint8_t *rnd                /* IN */) {
   ml_dsa_params params;
   ml_dsa_87_params_init(&params);
-  return crypto_sign_signature_internal(&params, sig, sig_len, message, message_len,
-                                        pre, pre_len, rnd, private_key) == 0;
+  return ml_dsa_sign_internal(&params, sig, sig_len, message, message_len,
+                              pre, pre_len, rnd, private_key) == 0;
 }
 
 int ml_dsa_87_verify(const uint8_t *public_key /* IN */,
@@ -210,8 +210,8 @@ int ml_dsa_87_verify(const uint8_t *public_key /* IN */,
                      size_t ctx_string_len     /* IN */) {
   ml_dsa_params params;
   ml_dsa_87_params_init(&params);
-  return crypto_sign_verify(&params, sig, sig_len, message, message_len,
-                            ctx_string, ctx_string_len, public_key) == 0;
+  return ml_dsa_verify(&params, sig, sig_len, message, message_len,
+                       ctx_string, ctx_string_len, public_key) == 0;
 }
 
 int ml_dsa_87_verify_internal(const uint8_t *public_key /* IN */,
@@ -223,7 +223,6 @@ int ml_dsa_87_verify_internal(const uint8_t *public_key /* IN */,
                               size_t pre_len            /* IN */) {
   ml_dsa_params params;
   ml_dsa_87_params_init(&params);
-  return crypto_sign_verify_internal(&params, sig, sig_len, message, message_len,
-                                     pre, pre_len, public_key) == 0;
+  return ml_dsa_verify_internal(&params, sig, sig_len, message, message_len,
+                                pre, pre_len, public_key) == 0;
 }
-

crypto/dilithium/pqcrystals_dilithium_ref_common/ntt.c

@@ -3,7 +3,7 @@
 #include "ntt.h"
 #include "reduce.h"
 
-static const int32_t zetas[N] = {
+static const int32_t zetas[ML_DSA_N] = {
          0,    25847, -2608894,  -518909,   237124,  -777960,  -876248,   466468,
    1826347,  2353451,  -359251, -2091905,  3119733, -2884855,  3111497,  2680103,
    2725464,  1024112, -1079900,  3585928,  -549488, -1119584,  2619752, -2108549,
@@ -39,24 +39,24 @@ static const int32_t zetas[N] = {
 };
 
 /*************************************************
-* Name:        ntt
+* Name:        ml_dsa_ntt
 *
 * Description: FIPS 204: Algorithm 41.
 *              Forward NTT, in-place. No modular reduction is performed after
 *              additions or subtractions. Output vector is in bitreversed order.
 *
 * Arguments:   - uint32_t p[N]: input/output coefficient array
 **************************************************/
-void ntt(int32_t a[N]) {
+void ml_dsa_ntt(int32_t a[ML_DSA_N]) {
   unsigned int len, start, j, k;
   int32_t zeta, t;
 
   k = 0;
   for(len = 128; len > 0; len >>= 1) {
-    for(start = 0; start < N; start = j + len) {
+    for(start = 0; start < ML_DSA_N; start = j + len) {
       zeta = zetas[++k];
       for(j = start; j < start + len; ++j) {
-        t = fqmul(zeta, a[j + len]);
+        t = ml_dsa_fqmul(zeta, a[j + len]);
         a[j + len] = a[j] - t;
         a[j] = a[j] + t;
       }
@@ -65,7 +65,7 @@ void ntt(int32_t a[N]) {
 }
 
 /*************************************************
-* Name:        invntt_tomont
+* Name:        ml_dsa_invntt_tomont
 *
 * Description: FIPS 204: Algorithm 42.
 *              Inverse NTT and multiplication by Montgomery factor 2^32.
@@ -76,25 +76,25 @@ void ntt(int32_t a[N]) {
 *
 * Arguments:   - uint32_t p[N]: input/output coefficient array
 **************************************************/
-void invntt_tomont(int32_t a[N]) {
+void ml_dsa_invntt_tomont(int32_t a[ML_DSA_N]) {
   unsigned int start, len, j, k;
   int32_t t, zeta;
   const int32_t f = 41978; // mont^2/256
 
   k = 256;
-  for(len = 1; len < N; len <<= 1) {
-    for(start = 0; start < N; start = j + len) {
+  for(len = 1; len < ML_DSA_N; len <<= 1) {
+    for(start = 0; start < ML_DSA_N; start = j + len) {
       zeta = -zetas[--k];
       for(j = start; j < start + len; ++j) {
         t = a[j];
         a[j] = t + a[j + len];
         a[j + len] = t - a[j + len];
-        a[j + len] = fqmul(zeta, a[j + len]);
+        a[j + len] = ml_dsa_fqmul(zeta, a[j + len]);
       }
     }
   }
 
-  for(j = 0; j < N; ++j) {
-    a[j] = fqmul(f, a[j]);
+  for(j = 0; j < ML_DSA_N; ++j) {
+    a[j] = ml_dsa_fqmul(f, a[j]);
   }
 }

crypto/dilithium/pqcrystals_dilithium_ref_common/ntt.h

@@ -1,11 +1,11 @@
-#ifndef NTT_H
-#define NTT_H
+#ifndef ML_DSA_NTT_H
+#define ML_DSA_NTT_H
 
 #include <stdint.h>
 #include "params.h"
 
-void ntt(int32_t a[N]);
+void ml_dsa_ntt(int32_t a[ML_DSA_N]);
 
-void invntt_tomont(int32_t a[N]);
+void ml_dsa_invntt_tomont(int32_t a[ML_DSA_N]);
 
 #endif