Low-memory dilithium with masked hint vector computation

A data processing system comprising instructions embodied in a non-transitory computer readable medium, the instructions for a method of performing a Dilithium signature operation on a message M using a secret key sk, the instructions, comprising:

• calculating a value {tilde over (r)} based upon w0, c, and s2, where w0 and c are calculated as part of the Dilithium signature operation and s2 is part of the secret key sk;
• performing a bound check on {tilde over (r)} based upon γ2 and β, where γ2 and β are parameters of the Dilithium signature operation;
• calculating a hint h based on the value {tilde over (r)} and deleting the value {tilde over (r)} in a memory;
• regenerating a value y using an ExpandMask function;
• calculating z based upon y, c, and s1, where s1 is part of the secret key sk and replacing y with z in the memory;
• performing a bound check on z based on γ1 and β, where γ1 is a parameter of the Dilithium signature operation;
• and
• returning a digital signature of the message M where the digital signature includes z and h.