Commit eb2d252133 for openssl.org

commit eb2d252133cbe504de1d64a77573974cb3498f60
Author: Igor Ustinov <igus@openssl.foundation>
Date:   Thu Jul 30 10:58:55 2026 +0200

    Commentary justifying non-constant-time memcmp

    Reviewed-by: Matt Caswell <matt@openssl.foundation>
    Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
    MergeDate: Fri Aug  7 13:35:40 2026
    (Merged from https://github.com/openssl/openssl/pull/32098)

diff --git a/crypto/ml_dsa/ml_dsa_key.c b/crypto/ml_dsa/ml_dsa_key.c
index ea5f4ee4da..f1cc5e694a 100644
--- a/crypto/ml_dsa/ml_dsa_key.c
+++ b/crypto/ml_dsa/ml_dsa_key.c
@@ -500,6 +500,11 @@ int ossl_ml_dsa_generate_key(ML_DSA_KEY *out)
     if (sk == NULL) {
         ret = keygen_internal(out);
     } else {
+        /*
+         * A constant-time comparison is unnecessary here since this check
+         * is only performed during key generation and is not exposed to
+         * timing attacks.
+         */
         if ((ret = keygen_internal(out)) != 0
             && memcmp(out->priv_encoding, sk, out->params->sk_len) != 0) {
             ret = 0;