mirror of
https://github.com/open-quantum-safe/liboqs.git
synced 2025-12-15 00:03:27 -05:00
Replace the Kyber768 implementation in liboqs master with PQClean's implementation (#466)
* Initial import of PQClean's Kyber768 clean implementation
* Integrate PQClean's Kyber768 into liboqs master
* Exempt PQClean code from namespacing and prettyprint
* Build PQClean's Kyber768 on Windows
* Add PQClean shim headers to Windows build
* Include PQClean's shim headers on Windows
* Update Kyber768 implementation from PQClean
Commit
0fa56021d1
* Update algorithm datasheet for Kyber768 PQClean
This commit is contained in:
Douglas Stebila
GitHub
parent
e0eda13ca8
commit
ab2c96a65e
@ -4,7 +4,7 @@ set -e
|
||||
|
||||
source $(dirname $0)/defs.sh
|
||||
|
||||
REGEX=' T [_]?(OQS|picnic|Keccak|.*SIKEp503|.*SIDHp503|.*SIKEp751|.*SIDHp751|.*shake128|.*shake256|rand_bytes|cpu_supports|uint64_from_char_array|uint64_to_char_array|print_hex|ntt_double|rec|aligned_alloc|aligned_free)'
|
||||
REGEX=' T [_]?(OQS|PQCLEAN|picnic|Keccak|.*SIKEp503|.*SIDHp503|.*SIKEp751|.*SIDHp751|.*shake128|.*shake256|rand_bytes|cpu_supports|uint64_from_char_array|uint64_to_char_array|print_hex|ntt_double|rec|aligned_alloc|aligned_free)'
|
||||
|
||||
# For catching errors, we have the first (otherwise superfluous) two lines below two make sure that the commands are being executed correctly
|
||||
NON_NAMESPACED=`nm -g .libs/liboqs.a`
|
||||
|
||||
@ -106,6 +106,6 @@ clean-kats:
|
||||
rm -rf tests/kat_kem kat_kem_rsp/
|
||||
|
||||
prettyprint:
|
||||
find src tests -name '*.c' -o -name '*.h' | grep -v picnic/external* | xargs $(CLANGFORMAT) -style=file -i
|
||||
find src tests -name '*.c' -o -name '*.h' | grep -v picnic/external* | grep -v pqclean | xargs $(CLANGFORMAT) -style=file -i
|
||||
|
||||
docs: links doxygen-run
|
||||
|
||||
@ -251,7 +251,7 @@
|
||||
<Optimization>Disabled</Optimization>
|
||||
<PreprocessorDefinitions>_X86_;inline=__inline;PICNIC_STATIC;OPTIMIZED_LINEAR_LAYER_EVALUATION;REDUCED_ROUND_KEY_COMPUTATION;WITH_LOWMC_128_128_20;WITH_LOWMC_192_192_30;WITH_LOWMC_256_256_38;REDUCED_LINEAR_LAYER;AES_DISABLE_NI;CONSTANT_TIME;WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<SDLCheck>false</SDLCheck>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\common\pqclean_shims\;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
@ -285,7 +285,7 @@ copy "$(SolutionDir)..\src\sig\qtesla\sig_qtesla.h" "$(SolutionDir)include\oqs\"
|
||||
<Optimization>Disabled</Optimization>
|
||||
<PreprocessorDefinitions>_X86_;inline=__inline;PICNIC_STATIC;OPTIMIZED_LINEAR_LAYER_EVALUATION;REDUCED_ROUND_KEY_COMPUTATION;WITH_LOWMC_128_128_20;WITH_LOWMC_192_192_30;WITH_LOWMC_256_256_38;REDUCED_LINEAR_LAYER;AES_DISABLE_NI;CONSTANT_TIME;WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<SDLCheck>false</SDLCheck>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\common\pqclean_shims\;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
@ -320,7 +320,7 @@ copy "$(SolutionDir)..\src\sig\qtesla\sig_qtesla.h" "$(SolutionDir)include\oqs\"
|
||||
<Optimization>Disabled</Optimization>
|
||||
<PreprocessorDefinitions>_AMD64_;inline=__inline;PICNIC_STATIC;OPTIMIZED_LINEAR_LAYER_EVALUATION;REDUCED_ROUND_KEY_COMPUTATION;WITH_LOWMC_128_128_20;WITH_LOWMC_192_192_30;WITH_LOWMC_256_256_38;WITH_OPT;WITH_POPCNT;WITH_SSE2;WITH_AVX2;REDUCED_LINEAR_LAYER;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;CONSTANT_TIME;_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<SDLCheck>false</SDLCheck>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\common\pqclean_shims\;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
</ClCompile>
|
||||
@ -360,7 +360,7 @@ copy "$(SolutionDir)..\src\sig\qtesla\sig_qtesla.h" "$(SolutionDir)include\oqs\"
|
||||
<Optimization>Disabled</Optimization>
|
||||
<PreprocessorDefinitions>_AMD64_;inline=__inline;PICNIC_STATIC;OPTIMIZED_LINEAR_LAYER_EVALUATION;REDUCED_ROUND_KEY_COMPUTATION;WITH_LOWMC_128_128_20;WITH_LOWMC_192_192_30;WITH_LOWMC_256_256_38;WITH_OPT;WITH_POPCNT;WITH_SSE2;WITH_AVX2;REDUCED_LINEAR_LAYER;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;CONSTANT_TIME;_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<SDLCheck>false</SDLCheck>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\common\pqclean_shims\;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
</ClCompile>
|
||||
@ -402,7 +402,7 @@ copy "$(SolutionDir)..\src\sig\qtesla\sig_qtesla.h" "$(SolutionDir)include\oqs\"
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<PreprocessorDefinitions>_X86_;inline=__inline;PICNIC_STATIC;OPTIMIZED_LINEAR_LAYER_EVALUATION;REDUCED_ROUND_KEY_COMPUTATION;WITH_LOWMC_128_128_20;WITH_LOWMC_192_192_30;WITH_LOWMC_256_256_38;REDUCED_LINEAR_LAYER;AES_DISABLE_NI;CONSTANT_TIME;WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<SDLCheck>false</SDLCheck>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\common\pqclean_shims\;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
@ -440,7 +440,7 @@ copy "$(SolutionDir)..\src\sig\qtesla\sig_qtesla.h" "$(SolutionDir)include\oqs\"
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<PreprocessorDefinitions>_X86_;inline=__inline;PICNIC_STATIC;OPTIMIZED_LINEAR_LAYER_EVALUATION;REDUCED_ROUND_KEY_COMPUTATION;WITH_LOWMC_128_128_20;WITH_LOWMC_192_192_30;WITH_LOWMC_256_256_38;REDUCED_LINEAR_LAYER;AES_DISABLE_NI;CONSTANT_TIME;WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<SDLCheck>false</SDLCheck>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\common\pqclean_shims\;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
@ -479,7 +479,7 @@ copy "$(SolutionDir)..\src\sig\qtesla\sig_qtesla.h" "$(SolutionDir)include\oqs\"
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<PreprocessorDefinitions>_AMD64_;inline=__inline;PICNIC_STATIC;OPTIMIZED_LINEAR_LAYER_EVALUATION;REDUCED_ROUND_KEY_COMPUTATION;WITH_LOWMC_128_128_20;WITH_LOWMC_192_192_30;WITH_LOWMC_256_256_38;WITH_OPT;WITH_POPCNT;WITH_SSE2;WITH_AVX2;REDUCED_LINEAR_LAYER;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;CONSTANT_TIME;NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<SDLCheck>false</SDLCheck>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\common\pqclean_shims\;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
</ClCompile>
|
||||
@ -523,7 +523,7 @@ copy "$(SolutionDir)..\src\sig\qtesla\sig_qtesla.h" "$(SolutionDir)include\oqs\"
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<PreprocessorDefinitions>_AMD64_;inline=__inline;PICNIC_STATIC;OPTIMIZED_LINEAR_LAYER_EVALUATION;REDUCED_ROUND_KEY_COMPUTATION;WITH_LOWMC_128_128_20;WITH_LOWMC_192_192_30;WITH_LOWMC_256_256_38;WITH_OPT;WITH_POPCNT;WITH_SSE2;WITH_AVX2;REDUCED_LINEAR_LAYER;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;CONSTANT_TIME;NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<SDLCheck>false</SDLCheck>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<AdditionalIncludeDirectories>$(SolutionDir)include;$(SolutionDir)..\src\common\pqclean_shims\;$(SolutionDir)..\src\sig\picnic\external\;$(SolutionDir)..\src\sig\picnic\external\sha3\;$(SolutionDir)..\src\sig\picnic\external\sha3\opt64\;$(SolutionDir)..\src\kem\newhopenist</AdditionalIncludeDirectories>
|
||||
<RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
</ClCompile>
|
||||
|
||||
@ -9,7 +9,7 @@ Summary
|
||||
- **Main cryptographic assumption**: Module Learning With Errors (RLWE)
|
||||
- **Scheme authors**: Roberto Avanzi, Joppe Bos, Léo Ducas, Eike Kiltz, Tancrède Lepoint, Vadim Lyubashevsky, John M. Schanck, Peter Schwabe, Gregor Seiler, Damien Stehle
|
||||
- **Authors' website**: https://pq-crystals.org/kyber
|
||||
- **Added to liboqs by**: Peter Schwabe
|
||||
- **Added to liboqs by**: Peter Schwabe, Douglas Stebila
|
||||
|
||||
Parameter sets
|
||||
--------------
|
||||
@ -20,8 +20,8 @@ Parameter sets
|
||||
| Kyber-768-CCA-KEM | IND-CCA | 3 | 1088 | 2400 | 1152 | 32 |
|
||||
| Kyber-1024-CCA-KEM | IND-CCA | 5 | 1440 | 3168 | 1504 | 32 |
|
||||
|
||||
Implementation
|
||||
--------------
|
||||
Implementation of Kyber-512-CCA-KEM and Kyber-1024-CCA-KEM
|
||||
----------------------------------------------------------
|
||||
|
||||
- **Source of implementation:** https://github.com/pq-crystals/kyber/
|
||||
- **Implementation version:** ab996e7460e5356b0e23aa034e7c2fe6922e60e6
|
||||
@ -30,6 +30,17 @@ Implementation
|
||||
- **Constant-time:** Yes
|
||||
- **Architectures supported in liboqs master branch**: x86, x64
|
||||
|
||||
Implementation of Kyber-768-CCA-KEM
|
||||
-----------------------------------
|
||||
|
||||
- **Source of implementation:** https://github.com/PQClean/PQClean/tree/master/crypto_kem/kyber768/clean
|
||||
- **Implementation version:** 0fa56021d1bd68ba59553ba20415c0f052568891
|
||||
- **License:** Public domain
|
||||
- **Language:** C
|
||||
- **Constant-time:** Yes
|
||||
- **Architectures supported in liboqs master branch**: x86, x64
|
||||
|
||||
|
||||
Additional comments
|
||||
-------------------
|
||||
|
||||
|
||||
21
src/common/pqclean_shims/fips202.h
Normal file
21
src/common/pqclean_shims/fips202.h
Normal file
@ -0,0 +1,21 @@
|
||||
#ifndef FIPS202_H
|
||||
#define FIPS202_H
|
||||
|
||||
#include <oqs/sha3.h>
|
||||
|
||||
#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE
|
||||
#define SHAKE256_RATE OQS_SHA3_SHAKE256_RATE
|
||||
#define SHA3_256_RATE OQS_SHA3_SHA3_256_RATE
|
||||
#define SHA3_512_RATE OQS_SHA3_SHA3_512_RATE
|
||||
|
||||
#define shake128_absorb OQS_SHA3_shake128_absorb
|
||||
#define shake128_squeezeblocks OQS_SHA3_shake128_squeezeblocks
|
||||
#define shake256_absorb OQS_SHA3_shake256_absorb
|
||||
#define shake256_squeezeblocks OQS_SHA3_shake256_squeezeblocks
|
||||
#define shake128 OQS_SHA3_shake128
|
||||
#define shake256 OQS_SHA3_shake256
|
||||
|
||||
#define sha3_256 OQS_SHA3_sha3256
|
||||
#define sha3_512 OQS_SHA3_sha3512
|
||||
|
||||
#endif
|
||||
8
src/common/pqclean_shims/randombytes.h
Normal file
8
src/common/pqclean_shims/randombytes.h
Normal file
@ -0,0 +1,8 @@
|
||||
#ifndef RANDOMBYTES_H
|
||||
#define RANDOMBYTES_H
|
||||
|
||||
#include <oqs/rand.h>
|
||||
|
||||
#define randombytes OQS_randombytes
|
||||
|
||||
#endif
|
||||
@ -2305,6 +2305,9 @@ void OQS_SHA3_shake128(uint8_t *output, size_t outlen, const uint8_t *input, siz
|
||||
}
|
||||
|
||||
void OQS_SHA3_shake128_absorb(uint64_t *state, const uint8_t *input, size_t inplen) {
|
||||
for (size_t i = 0; i < SHA3_STATESIZE; ++i) {
|
||||
state[i] = 0;
|
||||
}
|
||||
OQS_SHA3_keccak_absorb(state, SHA3_SHAKE128_RATE, input, inplen, SHA3_SHAKE_DOMAIN);
|
||||
}
|
||||
|
||||
@ -2338,6 +2341,9 @@ void OQS_SHA3_shake256(uint8_t *output, size_t outlen, const uint8_t *input, siz
|
||||
}
|
||||
|
||||
void OQS_SHA3_shake256_absorb(uint64_t *state, const uint8_t *input, size_t inplen) {
|
||||
for (size_t i = 0; i < SHA3_STATESIZE; ++i) {
|
||||
state[i] = 0;
|
||||
}
|
||||
OQS_SHA3_keccak_absorb(state, SHA3_SHAKE256_RATE, input, inplen, SHA3_SHAKE_DOMAIN);
|
||||
}
|
||||
|
||||
|
||||
@ -15,9 +15,10 @@ KYBER_CSRCS += $(KYBER_SRC_DIR)/ntt.c $(KYBER_SRC_DIR)/poly.c $(KYBER_SRC_DIR)/p
|
||||
KYBER_CSRCS += $(KYBER_SRC_DIR)/precomp.c $(KYBER_SRC_DIR)/reduce.c $(KYBER_SRC_DIR)/verify.c
|
||||
|
||||
libkemkyber_512_cca_la_SOURCES = $(KYBER_CSRCS)
|
||||
libkemkyber_768_cca_la_SOURCES = $(KYBER_CSRCS)
|
||||
libkemkyber_1024_cca_la_SOURCES = $(KYBER_CSRCS)
|
||||
|
||||
libkemkyber_512_cca_la_CFLAGS = $(COMMON_FLAGS) -DKYBER_K=2 -DFUNC_PREFIX=OQS_KEM_kyber_512_cca_kem
|
||||
libkemkyber_768_cca_la_CFLAGS = $(COMMON_FLAGS) -DKYBER_K=3 -DFUNC_PREFIX=OQS_KEM_kyber_768_cca_kem
|
||||
libkemkyber_1024_cca_la_CFLAGS = $(COMMON_FLAGS) -DKYBER_K=4 -DFUNC_PREFIX=OQS_KEM_kyber_1024_cca_kem
|
||||
|
||||
libkemkyber_768_cca_la_SOURCES = pqclean_kyber768_clean/cbd.c pqclean_kyber768_clean/indcpa.c pqclean_kyber768_clean/kem.c pqclean_kyber768_clean/ntt.c pqclean_kyber768_clean/poly.c pqclean_kyber768_clean/polyvec.c pqclean_kyber768_clean/precomp.c pqclean_kyber768_clean/reduce.c pqclean_kyber768_clean/verify.c
|
||||
libkemkyber_768_cca_la_CFLAGS = $(COMMON_FLAGS) -I../../common/pqclean_shims
|
||||
|
||||
@ -57,6 +57,25 @@ OQS_KEM *OQS_KEM_kyber_768_cca_kem_new() {
|
||||
return kem;
|
||||
}
|
||||
|
||||
int PQCLEAN_KYBER768_CLEAN_crypto_kem_keypair(unsigned char *pk, unsigned char *sk);
|
||||
int PQCLEAN_KYBER768_CLEAN_crypto_kem_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk);
|
||||
int PQCLEAN_KYBER768_CLEAN_crypto_kem_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk);
|
||||
|
||||
OQS_API OQS_STATUS OQS_KEM_kyber_768_cca_kem_keypair(uint8_t *public_key,
|
||||
uint8_t *secret_key) {
|
||||
return (OQS_STATUS) PQCLEAN_KYBER768_CLEAN_crypto_kem_keypair(public_key, secret_key);
|
||||
}
|
||||
OQS_API OQS_STATUS OQS_KEM_kyber_768_cca_kem_encaps(uint8_t *ciphertext,
|
||||
uint8_t *shared_secret,
|
||||
const uint8_t *public_key) {
|
||||
return (OQS_STATUS) PQCLEAN_KYBER768_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key);
|
||||
}
|
||||
OQS_API OQS_STATUS OQS_KEM_kyber_768_cca_kem_decaps(uint8_t *shared_secret,
|
||||
const unsigned char *ciphertext,
|
||||
const uint8_t *secret_key) {
|
||||
return (OQS_STATUS) PQCLEAN_KYBER768_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key);
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
#ifdef OQS_ENABLE_KEM_kyber_1024_cca_kem
|
||||
|
||||
15
src/kem/kyber/pqclean_kyber768_clean/LICENSE
Normal file
15
src/kem/kyber/pqclean_kyber768_clean/LICENSE
Normal file
@ -0,0 +1,15 @@
|
||||
Public Domain
|
||||
Authors: Joppe Bos,
|
||||
Léo Ducas,
|
||||
Eike Kiltz ,
|
||||
Tancrède Lepoint,
|
||||
Vadim Lyubashevsky,
|
||||
John Schanck,
|
||||
Peter Schwabe,
|
||||
Gregor Seiler,
|
||||
Damien Stehlé
|
||||
|
||||
For Keccak and AES we are using public-domain
|
||||
code from sources and by authors listed in
|
||||
comments on top of the respective files.
|
||||
|
||||
19
src/kem/kyber/pqclean_kyber768_clean/api.h
Normal file
19
src/kem/kyber/pqclean_kyber768_clean/api.h
Normal file
@ -0,0 +1,19 @@
|
||||
#ifndef API_H
|
||||
#define API_H
|
||||
|
||||
#include "params.h"
|
||||
|
||||
#define CRYPTO_SECRETKEYBYTES KYBER_SECRETKEYBYTES
|
||||
#define CRYPTO_PUBLICKEYBYTES KYBER_PUBLICKEYBYTES
|
||||
#define CRYPTO_CIPHERTEXTBYTES KYBER_CIPHERTEXTBYTES
|
||||
#define CRYPTO_BYTES KYBER_SYMBYTES
|
||||
|
||||
#define CRYPTO_ALGNAME "Kyber768"
|
||||
|
||||
int PQCLEAN_KYBER768_CLEAN_crypto_kem_keypair(unsigned char *pk, unsigned char *sk);
|
||||
|
||||
int PQCLEAN_KYBER768_CLEAN_crypto_kem_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk);
|
||||
|
||||
int PQCLEAN_KYBER768_CLEAN_crypto_kem_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk);
|
||||
|
||||
#endif
|
||||
113
src/kem/kyber/pqclean_kyber768_clean/cbd.c
Normal file
113
src/kem/kyber/pqclean_kyber768_clean/cbd.c
Normal file
@ -0,0 +1,113 @@
|
||||
#include "cbd.h"
|
||||
|
||||
/*************************************************
|
||||
* Name: load_littleendian
|
||||
*
|
||||
* Description: load bytes into a 64-bit integer
|
||||
* in little-endian order
|
||||
*
|
||||
* Arguments: - const unsigned char *x: pointer to input byte array
|
||||
* - bytes: number of bytes to load, has to be <=
|
||||
*8
|
||||
*
|
||||
* Returns 64-bit unsigned integer loaded from x
|
||||
**************************************************/
|
||||
static uint64_t load_littleendian(const unsigned char *x, int bytes) {
|
||||
int i;
|
||||
uint64_t r = x[0];
|
||||
for (i = 1; i < bytes; i++) {
|
||||
r |= (uint64_t)x[i] << (8 * i);
|
||||
}
|
||||
return r;
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: cbd
|
||||
*
|
||||
* Description: Given an array of uniformly random bytes, compute
|
||||
* polynomial with coefficients distributed according to
|
||||
* a centered binomial distribution with parameter KYBER_ETA
|
||||
*
|
||||
* Arguments: - poly *r: pointer to output polynomial
|
||||
* - const unsigned char *buf: pointer to input byte array
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_cbd(poly *r, const unsigned char *buf) {
|
||||
#if KYBER_ETA == 3
|
||||
uint32_t t, d, a[4], b[4];
|
||||
int i, j;
|
||||
|
||||
for (i = 0; i < KYBER_N / 4; i++) {
|
||||
t = (uint32_t)load_littleendian(buf + 3 * i, 3);
|
||||
d = 0;
|
||||
for (j = 0; j < 3; j++) {
|
||||
d += (t >> j) & 0x249249;
|
||||
}
|
||||
|
||||
a[0] = d & 0x7;
|
||||
b[0] = (d >> 3) & 0x7;
|
||||
a[1] = (d >> 6) & 0x7;
|
||||
b[1] = (d >> 9) & 0x7;
|
||||
a[2] = (d >> 12) & 0x7;
|
||||
b[2] = (d >> 15) & 0x7;
|
||||
a[3] = (d >> 18) & 0x7;
|
||||
b[3] = (d >> 21);
|
||||
|
||||
r->coeffs[4 * i + 0] = (uint16_t)(a[0] + KYBER_Q - b[0]);
|
||||
r->coeffs[4 * i + 1] = (uint16_t)(a[1] + KYBER_Q - b[1]);
|
||||
r->coeffs[4 * i + 2] = (uint16_t)(a[2] + KYBER_Q - b[2]);
|
||||
r->coeffs[4 * i + 3] = (uint16_t)(a[3] + KYBER_Q - b[3]);
|
||||
}
|
||||
#elif KYBER_ETA == 4
|
||||
uint32_t t, d, a[4], b[4];
|
||||
int i, j;
|
||||
|
||||
for (i = 0; i < KYBER_N / 4; i++) {
|
||||
t = (uint32_t)load_littleendian(buf + 4 * i, 4);
|
||||
d = 0;
|
||||
for (j = 0; j < 4; j++) {
|
||||
d += (t >> j) & 0x11111111;
|
||||
}
|
||||
|
||||
a[0] = d & 0xf;
|
||||
b[0] = (d >> 4) & 0xf;
|
||||
a[1] = (d >> 8) & 0xf;
|
||||
b[1] = (d >> 12) & 0xf;
|
||||
a[2] = (d >> 16) & 0xf;
|
||||
b[2] = (d >> 20) & 0xf;
|
||||
a[3] = (d >> 24) & 0xf;
|
||||
b[3] = (d >> 28);
|
||||
|
||||
r->coeffs[4 * i + 0] = (uint16_t)(a[0] + KYBER_Q - b[0]);
|
||||
r->coeffs[4 * i + 1] = (uint16_t)(a[1] + KYBER_Q - b[1]);
|
||||
r->coeffs[4 * i + 2] = (uint16_t)(a[2] + KYBER_Q - b[2]);
|
||||
r->coeffs[4 * i + 3] = (uint16_t)(a[3] + KYBER_Q - b[3]);
|
||||
}
|
||||
#elif KYBER_ETA == 5
|
||||
uint64_t t, d, a[4], b[4];
|
||||
int i, j;
|
||||
|
||||
for (i = 0; i < KYBER_N / 4; i++) {
|
||||
t = load_littleendian(buf + 5 * i, 5);
|
||||
d = 0;
|
||||
for (j = 0; j < 5; j++) {
|
||||
d += (t >> j) & 0x0842108421UL;
|
||||
}
|
||||
|
||||
a[0] = d & 0x1f;
|
||||
b[0] = (d >> 5) & 0x1f;
|
||||
a[1] = (d >> 10) & 0x1f;
|
||||
b[1] = (d >> 15) & 0x1f;
|
||||
a[2] = (d >> 20) & 0x1f;
|
||||
b[2] = (d >> 25) & 0x1f;
|
||||
a[3] = (d >> 30) & 0x1f;
|
||||
b[3] = (d >> 35);
|
||||
|
||||
r->coeffs[4 * i + 0] = (uint16_t)(a[0] + KYBER_Q - b[0]);
|
||||
r->coeffs[4 * i + 1] = (uint16_t)(a[1] + KYBER_Q - b[1]);
|
||||
r->coeffs[4 * i + 2] = (uint16_t)(a[2] + KYBER_Q - b[2]);
|
||||
r->coeffs[4 * i + 3] = (uint16_t)(a[3] + KYBER_Q - b[3]);
|
||||
}
|
||||
#else
|
||||
#error "poly_getnoise in poly.c only supports eta in {3,4,5}"
|
||||
#endif
|
||||
}
|
||||
9
src/kem/kyber/pqclean_kyber768_clean/cbd.h
Normal file
9
src/kem/kyber/pqclean_kyber768_clean/cbd.h
Normal file
@ -0,0 +1,9 @@
|
||||
#ifndef CBD_H
|
||||
#define CBD_H
|
||||
|
||||
#include "poly.h"
|
||||
#include <stdint.h>
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_cbd(poly *r, const unsigned char *buf);
|
||||
|
||||
#endif
|
||||
310
src/kem/kyber/pqclean_kyber768_clean/indcpa.c
Normal file
310
src/kem/kyber/pqclean_kyber768_clean/indcpa.c
Normal file
@ -0,0 +1,310 @@
|
||||
#include "indcpa.h"
|
||||
#include "fips202.h"
|
||||
#include "ntt.h"
|
||||
#include "poly.h"
|
||||
#include "polyvec.h"
|
||||
#include "randombytes.h"
|
||||
#include <string.h>
|
||||
|
||||
/*************************************************
|
||||
* Name: pack_pk
|
||||
*
|
||||
* Description: Serialize the public key as concatenation of the
|
||||
* compressed and serialized vector of polynomials pk
|
||||
* and the public seed used to generate the matrix A.
|
||||
*
|
||||
* Arguments: unsigned char *r: pointer to the output serialized
|
||||
*public key const poly *pk: pointer to the input public-key
|
||||
*polynomial const unsigned char *seed: pointer to the input public seed
|
||||
**************************************************/
|
||||
static void pack_pk(unsigned char *r, const polyvec *pk, const unsigned char *seed) {
|
||||
int i;
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_compress(r, pk);
|
||||
for (i = 0; i < KYBER_SYMBYTES; i++) {
|
||||
r[i + KYBER_POLYVECCOMPRESSEDBYTES] = seed[i];
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: unpack_pk
|
||||
*
|
||||
* Description: De-serialize and decompress public key from a byte array;
|
||||
* approximate inverse of pack_pk
|
||||
*
|
||||
* Arguments: - polyvec *pk: pointer to output public-key
|
||||
*vector of polynomials
|
||||
* - unsigned char *seed: pointer to output seed to
|
||||
*generate matrix A
|
||||
* - const unsigned char *packedpk: pointer to input serialized
|
||||
*public key
|
||||
**************************************************/
|
||||
static void unpack_pk(polyvec *pk, unsigned char *seed, const unsigned char *packedpk) {
|
||||
int i;
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_decompress(pk, packedpk);
|
||||
|
||||
for (i = 0; i < KYBER_SYMBYTES; i++) {
|
||||
seed[i] = packedpk[i + KYBER_POLYVECCOMPRESSEDBYTES];
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: pack_ciphertext
|
||||
*
|
||||
* Description: Serialize the ciphertext as concatenation of the
|
||||
* compressed and serialized vector of polynomials b
|
||||
* and the compressed and serialized polynomial v
|
||||
*
|
||||
* Arguments: unsigned char *r: pointer to the output serialized
|
||||
*ciphertext const poly *pk: pointer to the input vector of
|
||||
*polynomials b const unsigned char *seed: pointer to the input polynomial v
|
||||
**************************************************/
|
||||
static void pack_ciphertext(unsigned char *r, const polyvec *b, const poly *v) {
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_compress(r, b);
|
||||
PQCLEAN_KYBER768_CLEAN_poly_compress(r + KYBER_POLYVECCOMPRESSEDBYTES, v);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: unpack_ciphertext
|
||||
*
|
||||
* Description: De-serialize and decompress ciphertext from a byte array;
|
||||
* approximate inverse of pack_ciphertext
|
||||
*
|
||||
* Arguments: - polyvec *b: pointer to the output vector of
|
||||
*polynomials b
|
||||
* - poly *v: pointer to the output polynomial v
|
||||
* - const unsigned char *c: pointer to the input serialized
|
||||
*ciphertext
|
||||
**************************************************/
|
||||
static void unpack_ciphertext(polyvec *b, poly *v, const unsigned char *c) {
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_decompress(b, c);
|
||||
PQCLEAN_KYBER768_CLEAN_poly_decompress(v, c + KYBER_POLYVECCOMPRESSEDBYTES);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: pack_sk
|
||||
*
|
||||
* Description: Serialize the secret key
|
||||
*
|
||||
* Arguments: - unsigned char *r: pointer to output serialized secret key
|
||||
* - const polyvec *sk: pointer to input vector of polynomials
|
||||
*(secret key)
|
||||
**************************************************/
|
||||
static void pack_sk(unsigned char *r, const polyvec *sk) {
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_tobytes(r, sk);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: unpack_sk
|
||||
*
|
||||
* Description: De-serialize the secret key;
|
||||
* inverse of pack_sk
|
||||
*
|
||||
* Arguments: - polyvec *sk: pointer to output vector of
|
||||
*polynomials (secret key)
|
||||
* - const unsigned char *packedsk: pointer to input serialized
|
||||
*secret key
|
||||
**************************************************/
|
||||
static void unpack_sk(polyvec *sk, const unsigned char *packedsk) {
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_frombytes(sk, packedsk);
|
||||
}
|
||||
|
||||
#define gen_a(A, B) gen_matrix(A, B, 0)
|
||||
#define gen_at(A, B) gen_matrix(A, B, 1)
|
||||
|
||||
/*************************************************
|
||||
* Name: gen_matrix
|
||||
*
|
||||
* Description: Deterministically generate matrix A (or the transpose of A)
|
||||
* from a seed. Entries of the matrix are polynomials that look
|
||||
* uniformly random. Performs rejection sampling on output of
|
||||
* SHAKE-128
|
||||
*
|
||||
* Arguments: - polyvec *a: pointer to ouptput matrix A
|
||||
* - const unsigned char *seed: pointer to input seed
|
||||
* - int transposed: boolean deciding whether A or A^T
|
||||
*is generated
|
||||
**************************************************/
|
||||
static void gen_matrix(polyvec *a, const unsigned char *seed, int transposed) {
|
||||
unsigned int pos = 0, ctr;
|
||||
uint16_t val;
|
||||
unsigned int nblocks;
|
||||
const unsigned int maxnblocks = 4;
|
||||
uint8_t buf[SHAKE128_RATE * /* maxnblocks = */ 4];
|
||||
int i, j;
|
||||
uint64_t state[25]; // SHAKE state
|
||||
unsigned char extseed[KYBER_SYMBYTES + 2];
|
||||
|
||||
for (i = 0; i < KYBER_SYMBYTES; i++) {
|
||||
extseed[i] = seed[i];
|
||||
}
|
||||
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
for (j = 0; j < KYBER_K; j++) {
|
||||
ctr = pos = 0;
|
||||
nblocks = maxnblocks;
|
||||
if (transposed) {
|
||||
extseed[KYBER_SYMBYTES] = (unsigned char)i;
|
||||
extseed[KYBER_SYMBYTES + 1] = (unsigned char)j;
|
||||
} else {
|
||||
extseed[KYBER_SYMBYTES] = (unsigned char)j;
|
||||
extseed[KYBER_SYMBYTES + 1] = (unsigned char)i;
|
||||
}
|
||||
|
||||
shake128_absorb(state, extseed, KYBER_SYMBYTES + 2);
|
||||
shake128_squeezeblocks(buf, nblocks, state);
|
||||
|
||||
while (ctr < KYBER_N) {
|
||||
val = (buf[pos] | ((uint16_t)buf[pos + 1] << 8)) & 0x1fff;
|
||||
if (val < KYBER_Q) {
|
||||
a[i].vec[j].coeffs[ctr++] = val;
|
||||
}
|
||||
pos += 2;
|
||||
|
||||
if (pos > SHAKE128_RATE * nblocks - 2) {
|
||||
nblocks = 1;
|
||||
shake128_squeezeblocks(buf, nblocks, state);
|
||||
pos = 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: indcpa_keypair
|
||||
*
|
||||
* Description: Generates public and private key for the CPA-secure
|
||||
* public-key encryption scheme underlying Kyber
|
||||
*
|
||||
* Arguments: - unsigned char *pk: pointer to output public key (of length
|
||||
*KYBER_INDCPA_PUBLICKEYBYTES bytes)
|
||||
* - unsigned char *sk: pointer to output private key (of length
|
||||
*KYBER_INDCPA_SECRETKEYBYTES bytes)
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_indcpa_keypair(unsigned char *pk, unsigned char *sk) {
|
||||
polyvec a[KYBER_K], e, pkpv, skpv;
|
||||
unsigned char buf[KYBER_SYMBYTES + KYBER_SYMBYTES];
|
||||
unsigned char *publicseed = buf;
|
||||
unsigned char *noiseseed = buf + KYBER_SYMBYTES;
|
||||
int i;
|
||||
unsigned char nonce = 0;
|
||||
|
||||
randombytes(buf, KYBER_SYMBYTES);
|
||||
sha3_512(buf, buf, KYBER_SYMBYTES);
|
||||
|
||||
gen_a(a, publicseed);
|
||||
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
PQCLEAN_KYBER768_CLEAN_poly_getnoise(skpv.vec + i, noiseseed, nonce++);
|
||||
}
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_ntt(&skpv);
|
||||
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
PQCLEAN_KYBER768_CLEAN_poly_getnoise(e.vec + i, noiseseed, nonce++);
|
||||
}
|
||||
|
||||
// matrix-vector multiplication
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_pointwise_acc(&pkpv.vec[i], &skpv, a + i);
|
||||
}
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_invntt(&pkpv);
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_add(&pkpv, &pkpv, &e);
|
||||
|
||||
pack_sk(sk, &skpv);
|
||||
pack_pk(pk, &pkpv, publicseed);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: indcpa_enc
|
||||
*
|
||||
* Description: Encryption function of the CPA-secure
|
||||
* public-key encryption scheme underlying Kyber.
|
||||
*
|
||||
* Arguments: - unsigned char *c: pointer to output ciphertext (of
|
||||
*length KYBER_INDCPA_BYTES bytes)
|
||||
* - const unsigned char *m: pointer to input message (of length
|
||||
*KYBER_INDCPA_MSGBYTES bytes)
|
||||
* - const unsigned char *pk: pointer to input public key (of
|
||||
*length KYBER_INDCPA_PUBLICKEYBYTES bytes)
|
||||
* - const unsigned char *coin: pointer to input random coins used
|
||||
*as seed (of length KYBER_SYMBYTES bytes) to deterministically generate all
|
||||
*randomness
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_indcpa_enc(unsigned char *c, const unsigned char *m,
|
||||
const unsigned char *pk,
|
||||
const unsigned char *coins) {
|
||||
polyvec sp, pkpv, ep, at[KYBER_K], bp;
|
||||
poly v, k, epp;
|
||||
unsigned char seed[KYBER_SYMBYTES];
|
||||
int i;
|
||||
unsigned char nonce = 0;
|
||||
|
||||
unpack_pk(&pkpv, seed, pk);
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_poly_frommsg(&k, m);
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_ntt(&pkpv);
|
||||
|
||||
gen_at(at, seed);
|
||||
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
PQCLEAN_KYBER768_CLEAN_poly_getnoise(sp.vec + i, coins, nonce++);
|
||||
}
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_ntt(&sp);
|
||||
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
PQCLEAN_KYBER768_CLEAN_poly_getnoise(ep.vec + i, coins, nonce++);
|
||||
}
|
||||
|
||||
// matrix-vector multiplication
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_pointwise_acc(&bp.vec[i], &sp, at + i);
|
||||
}
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_invntt(&bp);
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_add(&bp, &bp, &ep);
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_pointwise_acc(&v, &pkpv, &sp);
|
||||
PQCLEAN_KYBER768_CLEAN_poly_invntt(&v);
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_poly_getnoise(&epp, coins, nonce++);
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_poly_add(&v, &v, &epp);
|
||||
PQCLEAN_KYBER768_CLEAN_poly_add(&v, &v, &k);
|
||||
|
||||
pack_ciphertext(c, &bp, &v);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: indcpa_dec
|
||||
*
|
||||
* Description: Decryption function of the CPA-secure
|
||||
* public-key encryption scheme underlying Kyber.
|
||||
*
|
||||
* Arguments: - unsigned char *m: pointer to output decrypted message
|
||||
*(of length KYBER_INDCPA_MSGBYTES)
|
||||
* - const unsigned char *c: pointer to input ciphertext (of
|
||||
*length KYBER_INDCPA_BYTES)
|
||||
* - const unsigned char *sk: pointer to input secret key (of
|
||||
*length KYBER_INDCPA_SECRETKEYBYTES)
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_indcpa_dec(unsigned char *m, const unsigned char *c,
|
||||
const unsigned char *sk) {
|
||||
polyvec bp, skpv;
|
||||
poly v, mp;
|
||||
|
||||
unpack_ciphertext(&bp, &v, c);
|
||||
unpack_sk(&skpv, sk);
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_ntt(&bp);
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_polyvec_pointwise_acc(&mp, &skpv, &bp);
|
||||
PQCLEAN_KYBER768_CLEAN_poly_invntt(&mp);
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_poly_sub(&mp, &mp, &v);
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_poly_tomsg(m, &mp);
|
||||
}
|
||||
16
src/kem/kyber/pqclean_kyber768_clean/indcpa.h
Normal file
16
src/kem/kyber/pqclean_kyber768_clean/indcpa.h
Normal file
@ -0,0 +1,16 @@
|
||||
#ifndef INDCPA_H
|
||||
#define INDCPA_H
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_indcpa_keypair(unsigned char *pk,
|
||||
unsigned char *sk);
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_indcpa_enc(unsigned char *c,
|
||||
const unsigned char *m,
|
||||
const unsigned char *pk,
|
||||
const unsigned char *coins);
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_indcpa_dec(unsigned char *m,
|
||||
const unsigned char *c,
|
||||
const unsigned char *sk);
|
||||
|
||||
#endif
|
||||
108
src/kem/kyber/pqclean_kyber768_clean/kem.c
Normal file
108
src/kem/kyber/pqclean_kyber768_clean/kem.c
Normal file
@ -0,0 +1,108 @@
|
||||
#include "api.h"
|
||||
#include "fips202.h"
|
||||
#include "indcpa.h"
|
||||
#include "params.h"
|
||||
#include "randombytes.h"
|
||||
#include "verify.h"
|
||||
|
||||
/*************************************************
|
||||
* Name: crypto_kem_keypair
|
||||
*
|
||||
* Description: Generates public and private key
|
||||
* for CCA-secure Kyber key encapsulation mechanism
|
||||
*
|
||||
* Arguments: - unsigned char *pk: pointer to output public key (an already
|
||||
*allocated array of CRYPTO_PUBLICKEYBYTES bytes)
|
||||
* - unsigned char *sk: pointer to output private key (an already
|
||||
*allocated array of CRYPTO_SECRETKEYBYTES bytes)
|
||||
*
|
||||
* Returns 0 (success)
|
||||
**************************************************/
|
||||
int PQCLEAN_KYBER768_CLEAN_crypto_kem_keypair(unsigned char *pk, unsigned char *sk) {
|
||||
size_t i;
|
||||
PQCLEAN_KYBER768_CLEAN_indcpa_keypair(pk, sk);
|
||||
for (i = 0; i < KYBER_INDCPA_PUBLICKEYBYTES; i++) {
|
||||
sk[i + KYBER_INDCPA_SECRETKEYBYTES] = pk[i];
|
||||
}
|
||||
sha3_256(sk + KYBER_SECRETKEYBYTES - 2 * KYBER_SYMBYTES, pk, KYBER_PUBLICKEYBYTES);
|
||||
randombytes(sk + KYBER_SECRETKEYBYTES - KYBER_SYMBYTES, KYBER_SYMBYTES); /* Value z for pseudo-random output on reject */
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: crypto_kem_enc
|
||||
*
|
||||
* Description: Generates cipher text and shared
|
||||
* secret for given public key
|
||||
*
|
||||
* Arguments: - unsigned char *ct: pointer to output cipher text (an
|
||||
*already allocated array of CRYPTO_CIPHERTEXTBYTES bytes)
|
||||
* - unsigned char *ss: pointer to output shared secret (an
|
||||
*already allocated array of CRYPTO_BYTES bytes)
|
||||
* - const unsigned char *pk: pointer to input public key (an
|
||||
*already allocated array of CRYPTO_PUBLICKEYBYTES bytes)
|
||||
*
|
||||
* Returns 0 (success)
|
||||
**************************************************/
|
||||
int PQCLEAN_KYBER768_CLEAN_crypto_kem_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk) {
|
||||
unsigned char kr[2 * KYBER_SYMBYTES]; /* Will contain key, coins */
|
||||
unsigned char buf[2 * KYBER_SYMBYTES];
|
||||
|
||||
randombytes(buf, KYBER_SYMBYTES);
|
||||
sha3_256(buf, buf, KYBER_SYMBYTES); /* Don't release system RNG output */
|
||||
|
||||
sha3_256(buf + KYBER_SYMBYTES, pk, KYBER_PUBLICKEYBYTES); /* Multitarget countermeasure for coins + contributory KEM */
|
||||
sha3_512(kr, buf, 2 * KYBER_SYMBYTES);
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_indcpa_enc(ct, buf, pk, kr + KYBER_SYMBYTES); /* coins are in kr+KYBER_SYMBYTES */
|
||||
|
||||
sha3_256(kr + KYBER_SYMBYTES, ct, KYBER_CIPHERTEXTBYTES); /* overwrite coins in kr with H(c) */
|
||||
sha3_256(ss, kr, 2 * KYBER_SYMBYTES); /* hash concatenation of pre-k and H(c) to k */
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: crypto_kem_dec
|
||||
*
|
||||
* Description: Generates shared secret for given
|
||||
* cipher text and private key
|
||||
*
|
||||
* Arguments: - unsigned char *ss: pointer to output shared secret (an
|
||||
*already allocated array of CRYPTO_BYTES bytes)
|
||||
* - const unsigned char *ct: pointer to input cipher text (an
|
||||
*already allocated array of CRYPTO_CIPHERTEXTBYTES bytes)
|
||||
* - const unsigned char *sk: pointer to input private key (an
|
||||
*already allocated array of CRYPTO_SECRETKEYBYTES bytes)
|
||||
*
|
||||
* Returns 0.
|
||||
*
|
||||
* On failure, ss will contain a pseudo-random value.
|
||||
**************************************************/
|
||||
int PQCLEAN_KYBER768_CLEAN_crypto_kem_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk) {
|
||||
size_t i;
|
||||
int fail;
|
||||
unsigned char cmp[KYBER_CIPHERTEXTBYTES];
|
||||
unsigned char buf[2 * KYBER_SYMBYTES];
|
||||
unsigned char
|
||||
kr[2 * KYBER_SYMBYTES]; /* Will contain key, coins, qrom-hash */
|
||||
const unsigned char *pk = sk + KYBER_INDCPA_SECRETKEYBYTES;
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_indcpa_dec(buf, ct, sk);
|
||||
|
||||
for (i = 0; i < KYBER_SYMBYTES; i++) { /* Multitarget countermeasure for coins + contributory KEM */
|
||||
buf[KYBER_SYMBYTES + i] = sk[KYBER_SECRETKEYBYTES - 2 * KYBER_SYMBYTES + i]; /* Save hash by storing H(pk) in sk */
|
||||
}
|
||||
sha3_512(kr, buf, 2 * KYBER_SYMBYTES);
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_indcpa_enc(cmp, buf, pk, kr + KYBER_SYMBYTES); /* coins are in kr+KYBER_SYMBYTES */
|
||||
|
||||
fail = PQCLEAN_KYBER768_CLEAN_verify(ct, cmp, KYBER_CIPHERTEXTBYTES);
|
||||
|
||||
sha3_256(kr + KYBER_SYMBYTES, ct, KYBER_CIPHERTEXTBYTES); /* overwrite coins in kr with H(c) */
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_cmov(kr, sk + KYBER_SECRETKEYBYTES - KYBER_SYMBYTES, KYBER_SYMBYTES, (unsigned char)fail); /* Overwrite pre-k with z on re-encryption failure */
|
||||
|
||||
sha3_256(ss, kr, 2 * KYBER_SYMBYTES); /* hash concatenation of pre-k and H(c) to k */
|
||||
|
||||
return 0;
|
||||
}
|
||||
80
src/kem/kyber/pqclean_kyber768_clean/ntt.c
Normal file
80
src/kem/kyber/pqclean_kyber768_clean/ntt.c
Normal file
@ -0,0 +1,80 @@
|
||||
#include "ntt.h"
|
||||
#include "inttypes.h"
|
||||
#include "params.h"
|
||||
#include "reduce.h"
|
||||
|
||||
extern const uint16_t PQCLEAN_KYBER768_CLEAN_omegas_inv_bitrev_montgomery[];
|
||||
extern const uint16_t PQCLEAN_KYBER768_CLEAN_psis_inv_montgomery[];
|
||||
extern const uint16_t PQCLEAN_KYBER768_CLEAN_zetas[];
|
||||
|
||||
/*************************************************
|
||||
* Name: ntt
|
||||
*
|
||||
* Description: Computes negacyclic number-theoretic transform (NTT) of
|
||||
* a polynomial (vector of 256 coefficients) in place;
|
||||
* inputs assumed to be in normal order, output in bitreversed
|
||||
*order
|
||||
*
|
||||
* Arguments: - uint16_t *p: pointer to in/output polynomial
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_ntt(uint16_t *p) {
|
||||
int level, start, j, k;
|
||||
uint16_t zeta, t;
|
||||
|
||||
k = 1;
|
||||
for (level = 7; level >= 0; level--) {
|
||||
for (start = 0; start < KYBER_N; start = j + (1 << level)) {
|
||||
zeta = PQCLEAN_KYBER768_CLEAN_zetas[k++];
|
||||
for (j = start; j < start + (1 << level); ++j) {
|
||||
t = PQCLEAN_KYBER768_CLEAN_montgomery_reduce((uint32_t)zeta * p[j + (1 << level)]);
|
||||
|
||||
p[j + (1 << level)] = PQCLEAN_KYBER768_CLEAN_barrett_reduce(p[j] + 4 * KYBER_Q - t);
|
||||
|
||||
if (level & 1) { /* odd level */
|
||||
p[j] = p[j] + t; /* Omit reduction (be lazy) */
|
||||
} else {
|
||||
p[j] = PQCLEAN_KYBER768_CLEAN_barrett_reduce(p[j] + t);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: invntt
|
||||
*
|
||||
* Description: Computes inverse of negacyclic number-theoretic transform (NTT)
|
||||
*of a polynomial (vector of 256 coefficients) in place; inputs assumed to be in
|
||||
*bitreversed order, output in normal order
|
||||
*
|
||||
* Arguments: - uint16_t *a: pointer to in/output polynomial
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_invntt(uint16_t *a) {
|
||||
int start, j, jTwiddle, level;
|
||||
uint16_t temp, W;
|
||||
uint32_t t;
|
||||
|
||||
for (level = 0; level < 8; level++) {
|
||||
for (start = 0; start < (1 << level); start++) {
|
||||
jTwiddle = 0;
|
||||
for (j = start; j < KYBER_N - 1; j += 2 * (1 << level)) {
|
||||
W = PQCLEAN_KYBER768_CLEAN_omegas_inv_bitrev_montgomery[jTwiddle++];
|
||||
temp = a[j];
|
||||
|
||||
if (level & 1) { /* odd level */
|
||||
a[j] = PQCLEAN_KYBER768_CLEAN_barrett_reduce((temp + a[j + (1 << level)]));
|
||||
} else {
|
||||
a[j] = (temp + a[j + (1 << level)]); /* Omit reduction (be lazy) */
|
||||
}
|
||||
|
||||
t = (W * ((uint32_t)temp + 4 * KYBER_Q - a[j + (1 << level)]));
|
||||
|
||||
a[j + (1 << level)] = PQCLEAN_KYBER768_CLEAN_montgomery_reduce(t);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for (j = 0; j < KYBER_N; j++) {
|
||||
a[j] = PQCLEAN_KYBER768_CLEAN_montgomery_reduce((a[j] * PQCLEAN_KYBER768_CLEAN_psis_inv_montgomery[j]));
|
||||
}
|
||||
}
|
||||
9
src/kem/kyber/pqclean_kyber768_clean/ntt.h
Normal file
9
src/kem/kyber/pqclean_kyber768_clean/ntt.h
Normal file
@ -0,0 +1,9 @@
|
||||
#ifndef NTT_H
|
||||
#define NTT_H
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_ntt(uint16_t *p);
|
||||
void PQCLEAN_KYBER768_CLEAN_invntt(uint16_t *a);
|
||||
|
||||
#endif
|
||||
27
src/kem/kyber/pqclean_kyber768_clean/params.h
Normal file
27
src/kem/kyber/pqclean_kyber768_clean/params.h
Normal file
@ -0,0 +1,27 @@
|
||||
#ifndef PARAMS_H
|
||||
#define PARAMS_H
|
||||
|
||||
#define KYBER_K 3
|
||||
|
||||
#define KYBER_N 256
|
||||
#define KYBER_Q 7681
|
||||
|
||||
#define KYBER_ETA 4
|
||||
|
||||
#define KYBER_SYMBYTES 32 /* size in bytes of shared key, hashes, and seeds */
|
||||
|
||||
#define KYBER_POLYBYTES 416
|
||||
#define KYBER_POLYCOMPRESSEDBYTES 96
|
||||
#define KYBER_POLYVECBYTES (KYBER_K * KYBER_POLYBYTES)
|
||||
#define KYBER_POLYVECCOMPRESSEDBYTES (KYBER_K * 352)
|
||||
|
||||
#define KYBER_INDCPA_MSGBYTES KYBER_SYMBYTES
|
||||
#define KYBER_INDCPA_PUBLICKEYBYTES (KYBER_POLYVECCOMPRESSEDBYTES + KYBER_SYMBYTES)
|
||||
#define KYBER_INDCPA_SECRETKEYBYTES (KYBER_POLYVECBYTES)
|
||||
#define KYBER_INDCPA_BYTES (KYBER_POLYVECCOMPRESSEDBYTES + KYBER_POLYCOMPRESSEDBYTES)
|
||||
|
||||
#define KYBER_PUBLICKEYBYTES (KYBER_INDCPA_PUBLICKEYBYTES)
|
||||
#define KYBER_SECRETKEYBYTES (KYBER_INDCPA_SECRETKEYBYTES + KYBER_INDCPA_PUBLICKEYBYTES + 2 * KYBER_SYMBYTES) /* 32 bytes of additional space to save H(pk) */
|
||||
#define KYBER_CIPHERTEXTBYTES KYBER_INDCPA_BYTES
|
||||
|
||||
#endif
|
||||
236
src/kem/kyber/pqclean_kyber768_clean/poly.c
Normal file
236
src/kem/kyber/pqclean_kyber768_clean/poly.c
Normal file
@ -0,0 +1,236 @@
|
||||
#include "poly.h"
|
||||
#include "cbd.h"
|
||||
#include "fips202.h"
|
||||
#include "ntt.h"
|
||||
#include "polyvec.h"
|
||||
#include "reduce.h"
|
||||
#include <stdio.h>
|
||||
|
||||
/*************************************************
|
||||
* Name: poly_compress
|
||||
*
|
||||
* Description: Compression and subsequent serialization of a polynomial
|
||||
*
|
||||
* Arguments: - unsigned char *r: pointer to output byte array
|
||||
* - const poly *a: pointer to input polynomial
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_compress(unsigned char *r, const poly *a) {
|
||||
uint32_t t[8];
|
||||
unsigned int i, j, k = 0;
|
||||
|
||||
for (i = 0; i < KYBER_N; i += 8) {
|
||||
for (j = 0; j < 8; j++) {
|
||||
t[j] = (((PQCLEAN_KYBER768_CLEAN_freeze(a->coeffs[i + j]) << 3) + KYBER_Q / 2) / KYBER_Q) & 7;
|
||||
}
|
||||
|
||||
r[k] = (unsigned char)( t[0] | (t[1] << 3) | (t[2] << 6));
|
||||
r[k + 1] = (unsigned char)((t[2] >> 2) | (t[3] << 1) | (t[4] << 4) | (t[5] << 7));
|
||||
r[k + 2] = (unsigned char)((t[5] >> 1) | (t[6] << 2) | (t[7] << 5));
|
||||
k += 3;
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: poly_decompress
|
||||
*
|
||||
* Description: De-serialization and subsequent decompression of a polynomial;
|
||||
* approximate inverse of poly_compress
|
||||
*
|
||||
* Arguments: - poly *r: pointer to output polynomial
|
||||
* - const unsigned char *a: pointer to input byte array
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_decompress(poly *r, const unsigned char *a) {
|
||||
unsigned int i;
|
||||
for (i = 0; i < KYBER_N; i += 8) {
|
||||
r->coeffs[i + 0] = (((a[0] & 7) * KYBER_Q) + 4) >> 3;
|
||||
r->coeffs[i + 1] = ((((a[0] >> 3) & 7) * KYBER_Q) + 4) >> 3;
|
||||
r->coeffs[i + 2] = ((((a[0] >> 6) | ((a[1] << 2) & 4)) * KYBER_Q) + 4) >> 3;
|
||||
r->coeffs[i + 3] = ((((a[1] >> 1) & 7) * KYBER_Q) + 4) >> 3;
|
||||
r->coeffs[i + 4] = ((((a[1] >> 4) & 7) * KYBER_Q) + 4) >> 3;
|
||||
r->coeffs[i + 5] = ((((a[1] >> 7) | ((a[2] << 1) & 6)) * KYBER_Q) + 4) >> 3;
|
||||
r->coeffs[i + 6] = ((((a[2] >> 2) & 7) * KYBER_Q) + 4) >> 3;
|
||||
r->coeffs[i + 7] = ((((a[2] >> 5)) * KYBER_Q) + 4) >> 3;
|
||||
a += 3;
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: poly_tobytes
|
||||
*
|
||||
* Description: Serialization of a polynomial
|
||||
*
|
||||
* Arguments: - unsigned char *r: pointer to output byte array
|
||||
* - const poly *a: pointer to input polynomial
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_tobytes(unsigned char *r, const poly *a) {
|
||||
int i, j;
|
||||
uint16_t t[8];
|
||||
|
||||
for (i = 0; i < KYBER_N / 8; i++) {
|
||||
for (j = 0; j < 8; j++) {
|
||||
t[j] = PQCLEAN_KYBER768_CLEAN_freeze(a->coeffs[8 * i + j]);
|
||||
}
|
||||
|
||||
r[13 * i + 0] = (unsigned char)( t[0] & 0xff);
|
||||
r[13 * i + 1] = (unsigned char)((t[0] >> 8) | ((t[1] & 0x07) << 5));
|
||||
r[13 * i + 2] = (unsigned char)((t[1] >> 3) & 0xff);
|
||||
r[13 * i + 3] = (unsigned char)((t[1] >> 11) | ((t[2] & 0x3f) << 2));
|
||||
r[13 * i + 4] = (unsigned char)((t[2] >> 6) | ((t[3] & 0x01) << 7));
|
||||
r[13 * i + 5] = (unsigned char)((t[3] >> 1) & 0xff);
|
||||
r[13 * i + 6] = (unsigned char)((t[3] >> 9) | ((t[4] & 0x0f) << 4));
|
||||
r[13 * i + 7] = (unsigned char)((t[4] >> 4) & 0xff);
|
||||
r[13 * i + 8] = (unsigned char)((t[4] >> 12) | ((t[5] & 0x7f) << 1));
|
||||
r[13 * i + 9] = (unsigned char)((t[5] >> 7) | ((t[6] & 0x03) << 6));
|
||||
r[13 * i + 10] = (unsigned char)((t[6] >> 2) & 0xff);
|
||||
r[13 * i + 11] = (unsigned char)((t[6] >> 10) | ((t[7] & 0x1f) << 3));
|
||||
r[13 * i + 12] = (unsigned char)((t[7] >> 5));
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: poly_frombytes
|
||||
*
|
||||
* Description: De-serialization of a polynomial;
|
||||
* inverse of poly_tobytes
|
||||
*
|
||||
* Arguments: - poly *r: pointer to output polynomial
|
||||
* - const unsigned char *a: pointer to input byte array
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_frombytes(poly *r, const unsigned char *a) {
|
||||
int i;
|
||||
for (i = 0; i < KYBER_N / 8; i++) {
|
||||
r->coeffs[8 * i + 0] = a[13 * i + 0] | (((uint16_t)a[13 * i + 1] & 0x1f) << 8);
|
||||
r->coeffs[8 * i + 1] = (a[13 * i + 1] >> 5) | (((uint16_t)a[13 * i + 2]) << 3) | (((uint16_t)a[13 * i + 3] & 0x03) << 11);
|
||||
r->coeffs[8 * i + 2] = (a[13 * i + 3] >> 2) | (((uint16_t)a[13 * i + 4] & 0x7f) << 6);
|
||||
r->coeffs[8 * i + 3] = (a[13 * i + 4] >> 7) | (((uint16_t)a[13 * i + 5]) << 1) | (((uint16_t)a[13 * i + 6] & 0x0f) << 9);
|
||||
r->coeffs[8 * i + 4] = (a[13 * i + 6] >> 4) | (((uint16_t)a[13 * i + 7]) << 4) | (((uint16_t)a[13 * i + 8] & 0x01) << 12);
|
||||
r->coeffs[8 * i + 5] = (a[13 * i + 8] >> 1) | (((uint16_t)a[13 * i + 9] & 0x3f) << 7);
|
||||
r->coeffs[8 * i + 6] = (a[13 * i + 9] >> 6) | (((uint16_t)a[13 * i + 10]) << 2) | (((uint16_t)a[13 * i + 11] & 0x07) << 10);
|
||||
r->coeffs[8 * i + 7] = (a[13 * i + 11] >> 3) | (((uint16_t)a[13 * i + 12]) << 5);
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: poly_getnoise
|
||||
*
|
||||
* Description: Sample a polynomial deterministically from a seed and a nonce,
|
||||
* with output polynomial close to centered binomial distribution
|
||||
* with parameter KYBER_ETA
|
||||
*
|
||||
* Arguments: - poly *r: pointer to output polynomial
|
||||
* - const unsigned char *seed: pointer to input seed
|
||||
* - unsigned char nonce: one-byte input nonce
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_getnoise(poly *r, const unsigned char *seed, unsigned char nonce) {
|
||||
unsigned char buf[KYBER_ETA * KYBER_N / 4];
|
||||
unsigned char extseed[KYBER_SYMBYTES + 1];
|
||||
int i;
|
||||
|
||||
for (i = 0; i < KYBER_SYMBYTES; i++) {
|
||||
extseed[i] = seed[i];
|
||||
}
|
||||
extseed[KYBER_SYMBYTES] = nonce;
|
||||
|
||||
shake256(buf, KYBER_ETA * KYBER_N / 4, extseed, KYBER_SYMBYTES + 1);
|
||||
|
||||
PQCLEAN_KYBER768_CLEAN_cbd(r, buf);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: poly_ntt
|
||||
*
|
||||
* Description: Computes negacyclic number-theoretic transform (NTT) of
|
||||
* a polynomial in place;
|
||||
* inputs assumed to be in normal order, output in bitreversed
|
||||
*order
|
||||
*
|
||||
* Arguments: - uint16_t *r: pointer to in/output polynomial
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_ntt(poly *r) {
|
||||
PQCLEAN_KYBER768_CLEAN_ntt(r->coeffs);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: poly_invntt
|
||||
*
|
||||
* Description: Computes inverse of negacyclic number-theoretic transform (NTT)
|
||||
*of a polynomial in place; inputs assumed to be in bitreversed order, output in
|
||||
*normal order
|
||||
*
|
||||
* Arguments: - uint16_t *a: pointer to in/output polynomial
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_invntt(poly *r) {
|
||||
PQCLEAN_KYBER768_CLEAN_invntt(r->coeffs);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: poly_add
|
||||
*
|
||||
* Description: Add two polynomials
|
||||
*
|
||||
* Arguments: - poly *r: pointer to output polynomial
|
||||
* - const poly *a: pointer to first input polynomial
|
||||
* - const poly *b: pointer to second input polynomial
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_add(poly *r, const poly *a, const poly *b) {
|
||||
int i;
|
||||
for (i = 0; i < KYBER_N; i++) {
|
||||
r->coeffs[i] = PQCLEAN_KYBER768_CLEAN_barrett_reduce(a->coeffs[i] + b->coeffs[i]);
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: poly_sub
|
||||
*
|
||||
* Description: Subtract two polynomials
|
||||
*
|
||||
* Arguments: - poly *r: pointer to output polynomial
|
||||
* - const poly *a: pointer to first input polynomial
|
||||
* - const poly *b: pointer to second input polynomial
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_sub(poly *r, const poly *a, const poly *b) {
|
||||
int i;
|
||||
for (i = 0; i < KYBER_N; i++) {
|
||||
r->coeffs[i] = PQCLEAN_KYBER768_CLEAN_barrett_reduce(a->coeffs[i] + 3 * KYBER_Q - b->coeffs[i]);
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: poly_frommsg
|
||||
*
|
||||
* Description: Convert 32-byte message to polynomial
|
||||
*
|
||||
* Arguments: - poly *r: pointer to output polynomial
|
||||
* - const unsigned char *msg: pointer to input message
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_frommsg(poly *r, const unsigned char msg[KYBER_SYMBYTES]) {
|
||||
uint16_t i, j, mask;
|
||||
|
||||
for (i = 0; i < KYBER_SYMBYTES; i++) {
|
||||
for (j = 0; j < 8; j++) {
|
||||
mask = -((msg[i] >> j) & 1);
|
||||
r->coeffs[8 * i + j] = mask & ((KYBER_Q + 1) / 2);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: poly_tomsg
|
||||
*
|
||||
* Description: Convert polynomial to 32-byte message
|
||||
*
|
||||
* Arguments: - unsigned char *msg: pointer to output message
|
||||
* - const poly *a: pointer to input polynomial
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_tomsg(unsigned char msg[KYBER_SYMBYTES], const poly *a) {
|
||||
uint16_t t;
|
||||
int i, j;
|
||||
|
||||
for (i = 0; i < KYBER_SYMBYTES; i++) {
|
||||
msg[i] = 0;
|
||||
for (j = 0; j < 8; j++) {
|
||||
t = (((PQCLEAN_KYBER768_CLEAN_freeze(a->coeffs[8 * i + j]) << 1) + KYBER_Q / 2) / KYBER_Q) & 1;
|
||||
msg[i] |= t << j;
|
||||
}
|
||||
}
|
||||
}
|
||||
32
src/kem/kyber/pqclean_kyber768_clean/poly.h
Normal file
32
src/kem/kyber/pqclean_kyber768_clean/poly.h
Normal file
@ -0,0 +1,32 @@
|
||||
#ifndef POLY_H
|
||||
#define POLY_H
|
||||
|
||||
#include "params.h"
|
||||
#include <stdint.h>
|
||||
|
||||
/*
|
||||
* Elements of R_q = Z_q[X]/(X^n + 1). Represents polynomial
|
||||
* coeffs[0] + X*coeffs[1] + X^2*xoeffs[2] + ... + X^{n-1}*coeffs[n-1]
|
||||
*/
|
||||
typedef struct {
|
||||
uint16_t coeffs[KYBER_N];
|
||||
} poly;
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_compress(unsigned char *r, const poly *a);
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_decompress(poly *r, const unsigned char *a);
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_tobytes(unsigned char *r, const poly *a);
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_frombytes(poly *r, const unsigned char *a);
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_frommsg(poly *r, const unsigned char msg[KYBER_SYMBYTES]);
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_tomsg(unsigned char msg[KYBER_SYMBYTES], const poly *a);
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_getnoise(poly *r, const unsigned char *seed, unsigned char nonce);
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_ntt(poly *r);
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_invntt(poly *r);
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_add(poly *r, const poly *a, const poly *b);
|
||||
void PQCLEAN_KYBER768_CLEAN_poly_sub(poly *r, const poly *a, const poly *b);
|
||||
|
||||
#endif
|
||||
162
src/kem/kyber/pqclean_kyber768_clean/polyvec.c
Normal file
162
src/kem/kyber/pqclean_kyber768_clean/polyvec.c
Normal file
@ -0,0 +1,162 @@
|
||||
#include "polyvec.h"
|
||||
#include "cbd.h"
|
||||
#include "fips202.h"
|
||||
#include "reduce.h"
|
||||
#include <stdio.h>
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_compress
|
||||
*
|
||||
* Description: Compress and serialize vector of polynomials
|
||||
*
|
||||
* Arguments: - unsigned char *r: pointer to output byte array
|
||||
* - const polyvec *a: pointer to input vector of polynomials
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_compress(unsigned char *r, const polyvec *a) {
|
||||
int i, j, k;
|
||||
uint16_t t[8];
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
for (j = 0; j < KYBER_N / 8; j++) {
|
||||
for (k = 0; k < 8; k++) {
|
||||
t[k] = ((((uint32_t)PQCLEAN_KYBER768_CLEAN_freeze(a->vec[i].coeffs[8 * j + k]) << 11) + KYBER_Q / 2) / KYBER_Q) & 0x7ff;
|
||||
}
|
||||
|
||||
r[11 * j + 0] = (unsigned char)( t[0] & 0xff);
|
||||
r[11 * j + 1] = (unsigned char)((t[0] >> 8) | ((t[1] & 0x1f) << 3));
|
||||
r[11 * j + 2] = (unsigned char)((t[1] >> 5) | ((t[2] & 0x03) << 6));
|
||||
r[11 * j + 3] = (unsigned char)((t[2] >> 2) & 0xff);
|
||||
r[11 * j + 4] = (unsigned char)((t[2] >> 10) | ((t[3] & 0x7f) << 1));
|
||||
r[11 * j + 5] = (unsigned char)((t[3] >> 7) | ((t[4] & 0x0f) << 4));
|
||||
r[11 * j + 6] = (unsigned char)((t[4] >> 4) | ((t[5] & 0x01) << 7));
|
||||
r[11 * j + 7] = (unsigned char)((t[5] >> 1) & 0xff);
|
||||
r[11 * j + 8] = (unsigned char)((t[5] >> 9) | ((t[6] & 0x3f) << 2));
|
||||
r[11 * j + 9] = (unsigned char)((t[6] >> 6) | ((t[7] & 0x07) << 5));
|
||||
r[11 * j + 10] = (unsigned char)((t[7] >> 3));
|
||||
}
|
||||
r += 352;
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_decompress
|
||||
*
|
||||
* Description: De-serialize and decompress vector of polynomials;
|
||||
* approximate inverse of polyvec_compress
|
||||
*
|
||||
* Arguments: - polyvec *r: pointer to output vector of polynomials
|
||||
* - unsigned char *a: pointer to input byte array
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_decompress(polyvec *r, const unsigned char *a) {
|
||||
int i, j;
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
for (j = 0; j < KYBER_N / 8; j++) {
|
||||
r->vec[i].coeffs[8 * j + 0] = (((a[11 * j + 0] | (((uint32_t)a[11 * j + 1] & 0x07) << 8)) * KYBER_Q) + 1024) >> 11;
|
||||
r->vec[i].coeffs[8 * j + 1] = ((((a[11 * j + 1] >> 3) | (((uint32_t)a[11 * j + 2] & 0x3f) << 5)) * KYBER_Q) + 1024) >> 11;
|
||||
r->vec[i].coeffs[8 * j + 2] = ((((a[11 * j + 2] >> 6) | (((uint32_t)a[11 * j + 3] & 0xff) << 2) | (((uint32_t)a[11 * j + 4] & 0x01) << 10)) * KYBER_Q) + 1024) >> 11;
|
||||
r->vec[i].coeffs[8 * j + 3] = ((((a[11 * j + 4] >> 1) | (((uint32_t)a[11 * j + 5] & 0x0f) << 7)) * KYBER_Q) + 1024) >> 11;
|
||||
r->vec[i].coeffs[8 * j + 4] = ((((a[11 * j + 5] >> 4) | (((uint32_t)a[11 * j + 6] & 0x7f) << 4)) * KYBER_Q) + 1024) >> 11;
|
||||
r->vec[i].coeffs[8 * j + 5] = ((((a[11 * j + 6] >> 7) | (((uint32_t)a[11 * j + 7] & 0xff) << 1) | (((uint32_t)a[11 * j + 8] & 0x03) << 9)) * KYBER_Q) + 1024) >> 11;
|
||||
r->vec[i].coeffs[8 * j + 6] = ((((a[11 * j + 8] >> 2) | (((uint32_t)a[11 * j + 9] & 0x1f) << 6)) * KYBER_Q) + 1024) >> 11;
|
||||
r->vec[i].coeffs[8 * j + 7] = ((((a[11 * j + 9] >> 5) | (((uint32_t)a[11 * j + 10] & 0xff) << 3)) * KYBER_Q) + 1024) >> 11;
|
||||
}
|
||||
a += 352;
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_tobytes
|
||||
*
|
||||
* Description: Serialize vector of polynomials
|
||||
*
|
||||
* Arguments: - unsigned char *r: pointer to output byte array
|
||||
* - const polyvec *a: pointer to input vector of polynomials
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_tobytes(unsigned char *r, const polyvec *a) {
|
||||
int i;
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
PQCLEAN_KYBER768_CLEAN_poly_tobytes(r + i * KYBER_POLYBYTES, &a->vec[i]);
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_frombytes
|
||||
*
|
||||
* Description: De-serialize vector of polynomials;
|
||||
* inverse of polyvec_tobytes
|
||||
*
|
||||
* Arguments: - unsigned char *r: pointer to output byte array
|
||||
* - const polyvec *a: pointer to input vector of polynomials
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_frombytes(polyvec *r, const unsigned char *a) {
|
||||
int i;
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
PQCLEAN_KYBER768_CLEAN_poly_frombytes(&r->vec[i], a + i * KYBER_POLYBYTES);
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_ntt
|
||||
*
|
||||
* Description: Apply forward NTT to all elements of a vector of polynomials
|
||||
*
|
||||
* Arguments: - polyvec *r: pointer to in/output vector of polynomials
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_ntt(polyvec *r) {
|
||||
int i;
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
PQCLEAN_KYBER768_CLEAN_poly_ntt(&r->vec[i]);
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_invntt
|
||||
*
|
||||
* Description: Apply inverse NTT to all elements of a vector of polynomials
|
||||
*
|
||||
* Arguments: - polyvec *r: pointer to in/output vector of polynomials
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_invntt(polyvec *r) {
|
||||
int i;
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
PQCLEAN_KYBER768_CLEAN_poly_invntt(&r->vec[i]);
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_pointwise_acc
|
||||
*
|
||||
* Description: Pointwise multiply elements of a and b and accumulate into r
|
||||
*
|
||||
* Arguments: - poly *r: pointer to output polynomial
|
||||
* - const polyvec *a: pointer to first input vector of polynomials
|
||||
* - const polyvec *b: pointer to second input vector of polynomials
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_pointwise_acc(poly *r, const polyvec *a, const polyvec *b) {
|
||||
int i, j;
|
||||
uint16_t t;
|
||||
for (j = 0; j < KYBER_N; j++) {
|
||||
t = PQCLEAN_KYBER768_CLEAN_montgomery_reduce(4613 * (uint32_t)b->vec[0].coeffs[j]); // 4613 = 2^{2*18} % q
|
||||
r->coeffs[j] = PQCLEAN_KYBER768_CLEAN_montgomery_reduce(a->vec[0].coeffs[j] * t);
|
||||
for (i = 1; i < KYBER_K; i++) {
|
||||
t = PQCLEAN_KYBER768_CLEAN_montgomery_reduce(4613 * (uint32_t)b->vec[i].coeffs[j]);
|
||||
r->coeffs[j] += PQCLEAN_KYBER768_CLEAN_montgomery_reduce(a->vec[i].coeffs[j] * t);
|
||||
}
|
||||
r->coeffs[j] = PQCLEAN_KYBER768_CLEAN_barrett_reduce(r->coeffs[j]);
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_add
|
||||
*
|
||||
* Description: Add vectors of polynomials
|
||||
*
|
||||
* Arguments: - polyvec *r: pointer to output vector of polynomials
|
||||
* - const polyvec *a: pointer to first input vector of polynomials
|
||||
* - const polyvec *b: pointer to second input vector of polynomials
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_add(polyvec *r, const polyvec *a, const polyvec *b) {
|
||||
int i;
|
||||
for (i = 0; i < KYBER_K; i++) {
|
||||
PQCLEAN_KYBER768_CLEAN_poly_add(&r->vec[i], &a->vec[i], &b->vec[i]);
|
||||
}
|
||||
}
|
||||
24
src/kem/kyber/pqclean_kyber768_clean/polyvec.h
Normal file
24
src/kem/kyber/pqclean_kyber768_clean/polyvec.h
Normal file
@ -0,0 +1,24 @@
|
||||
#ifndef POLYVEC_H
|
||||
#define POLYVEC_H
|
||||
|
||||
#include "params.h"
|
||||
#include "poly.h"
|
||||
|
||||
typedef struct {
|
||||
poly vec[KYBER_K];
|
||||
} polyvec;
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_compress(unsigned char *r, const polyvec *a);
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_decompress(polyvec *r, const unsigned char *a);
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_tobytes(unsigned char *r, const polyvec *a);
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_frombytes(polyvec *r, const unsigned char *a);
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_ntt(polyvec *r);
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_invntt(polyvec *r);
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_pointwise_acc(poly *r, const polyvec *a, const polyvec *b);
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_polyvec_add(polyvec *r, const polyvec *a, const polyvec *b);
|
||||
|
||||
#endif
|
||||
100
src/kem/kyber/pqclean_kyber768_clean/precomp.c
Normal file
100
src/kem/kyber/pqclean_kyber768_clean/precomp.c
Normal file
@ -0,0 +1,100 @@
|
||||
#include "inttypes.h"
|
||||
#include "ntt.h"
|
||||
#include "params.h"
|
||||
|
||||
/* Precomputed constants for the forward NTT and inverse NTT.
|
||||
* Computed using Pari/GP as follows:
|
||||
*
|
||||
brv=[0,128,64,192,32,160,96,224,16,144,80,208,48,176,112,240, \
|
||||
8,136,72,200,40,168,104,232,24,152,88,216,56,184,120,248, \
|
||||
4,132,68,196,36,164,100,228,20,148,84,212,52,180,116,244, \
|
||||
12,140,76,204,44,172,108,236,28,156,92,220,60,188,124,252, \
|
||||
2,130,66,194,34,162,98,226,18,146,82,210,50,178,114,242, \
|
||||
10,138,74,202,42,170,106,234,26,154,90,218,58,186,122,250, \
|
||||
6,134,70,198,38,166,102,230,22,150,86,214,54,182,118,246, \
|
||||
14,142,78,206,46,174,110,238,30,158,94,222,62,190,126,254, \
|
||||
1,129,65,193,33,161,97,225,17,145,81,209,49,177,113,241, \
|
||||
9,137,73,201,41,169,105,233,25,153,89,217,57,185,121,249, \
|
||||
5,133,69,197,37,165,101,229,21,149,85,213,53,181,117,245, \
|
||||
13,141,77,205,45,173,109,237,29,157,93,221,61,189,125,253, \
|
||||
3,131,67,195,35,163,99,227,19,147,83,211,51,179,115,243, \
|
||||
11,139,75,203,43,171,107,235,27,155,91,219,59,187,123,251, \
|
||||
7,135,71,199,39,167,103,231,23,151,87,215,55,183,119,247, \
|
||||
15,143,79,207,47,175,111,239,31,159,95,223,63,191,127,255];
|
||||
|
||||
q = 7681;
|
||||
n = 256;
|
||||
mont = Mod(2^18,q);
|
||||
|
||||
g=0; for(i=2,q-1,if(znorder(Mod(i,q)) == 2*n, g=Mod(i,q); break))
|
||||
|
||||
zetas = lift(vector(n, i, g^(brv[i])*mont))
|
||||
omegas_inv_bitrev_montgomery = lift(vector(n/2, i,
|
||||
(g^2)^(-brv[2*(i-1)+1])*mont)) psis_inv_montgomery = lift(vector(n, i,
|
||||
g^(-(i-1))/n*mont))
|
||||
|
||||
*/
|
||||
|
||||
const uint16_t PQCLEAN_KYBER768_CLEAN_zetas[KYBER_N] = {
|
||||
990, 7427, 2634, 6819, 578, 3281, 2143, 1095, 484, 6362, 3336, 5382,
|
||||
6086, 3823, 877, 5656, 3583, 7010, 6414, 263, 1285, 291, 7143, 7338,
|
||||
1581, 5134, 5184, 5932, 4042, 5775, 2468, 3, 606, 729, 5383, 962,
|
||||
3240, 7548, 5129, 7653, 5929, 4965, 2461, 641, 1584, 2666, 1142, 157,
|
||||
7407, 5222, 5602, 5142, 6140, 5485, 4931, 1559, 2085, 5284, 2056, 3538,
|
||||
7269, 3535, 7190, 1957, 3465, 6792, 1538, 4664, 2023, 7643, 3660, 7673,
|
||||
1694, 6905, 3995, 3475, 5939, 1859, 6910, 4434, 1019, 1492, 7087, 4761,
|
||||
657, 4859, 5798, 2640, 1693, 2607, 2782, 5400, 6466, 1010, 957, 3851,
|
||||
2121, 6392, 7319, 3367, 3659, 3375, 6430, 7583, 1549, 5856, 4773, 6084,
|
||||
5544, 1650, 3997, 4390, 6722, 2915, 4245, 2635, 6128, 7676, 5737, 1616,
|
||||
3457, 3132, 7196, 4702, 6239, 851, 2122, 3009, 7613, 7295, 2007, 323,
|
||||
5112, 3716, 2289, 6442, 6965, 2713, 7126, 3401, 963, 6596, 607, 5027,
|
||||
7078, 4484, 5937, 944, 2860, 2680, 5049, 1777, 5850, 3387, 6487, 6777,
|
||||
4812, 4724, 7077, 186, 6848, 6793, 3463, 5877, 1174, 7116, 3077, 5945,
|
||||
6591, 590, 6643, 1337, 6036, 3991, 1675, 2053, 6055, 1162, 1679, 3883,
|
||||
4311, 2106, 6163, 4486, 6374, 5006, 4576, 4288, 5180, 4102, 282, 6119,
|
||||
7443, 6330, 3184, 4971, 2530, 5325, 4171, 7185, 5175, 5655, 1898, 382,
|
||||
7211, 43, 5965, 6073, 1730, 332, 1577, 3304, 2329, 1699, 6150, 2379,
|
||||
5113, 333, 3502, 4517, 1480, 1172, 5567, 651, 925, 4573, 599, 1367,
|
||||
4109, 1863, 6929, 1605, 3866, 2065, 4048, 839, 5764, 2447, 2022, 3345,
|
||||
1990, 4067, 2036, 2069, 3567, 7371, 2368, 339, 6947, 2159, 654, 7327,
|
||||
2768, 6676, 987, 2214
|
||||
};
|
||||
|
||||
const uint16_t PQCLEAN_KYBER768_CLEAN_omegas_inv_bitrev_montgomery[KYBER_N / 2] = {
|
||||
990, 254, 862, 5047, 6586, 5538, 4400, 7103, 2025, 6804, 3858, 1595,
|
||||
2299, 4345, 1319, 7197, 7678, 5213, 1906, 3639, 1749, 2497, 2547, 6100,
|
||||
343, 538, 7390, 6396, 7418, 1267, 671, 4098, 5724, 491, 4146, 412,
|
||||
4143, 5625, 2397, 5596, 6122, 2750, 2196, 1541, 2539, 2079, 2459, 274,
|
||||
7524, 6539, 5015, 6097, 7040, 5220, 2716, 1752, 28, 2552, 133, 4441,
|
||||
6719, 2298, 6952, 7075, 4672, 5559, 6830, 1442, 2979, 485, 4549, 4224,
|
||||
6065, 1944, 5, 1553, 5046, 3436, 4766, 959, 3291, 3684, 6031, 2137,
|
||||
1597, 2908, 1825, 6132, 98, 1251, 4306, 4022, 4314, 362, 1289, 5560,
|
||||
3830, 6724, 6671, 1215, 2281, 4899, 5074, 5988, 5041, 1883, 2822, 7024,
|
||||
2920, 594, 6189, 6662, 3247, 771, 5822, 1742, 4206, 3686, 776, 5987,
|
||||
8, 4021, 38, 5658, 3017, 6143, 889, 4216
|
||||
};
|
||||
|
||||
const uint16_t PQCLEAN_KYBER768_CLEAN_psis_inv_montgomery[KYBER_N] = {
|
||||
1024, 4972, 5779, 6907, 4943, 4168, 315, 5580, 90, 497, 1123, 142,
|
||||
4710, 5527, 2443, 4871, 698, 2489, 2394, 4003, 684, 2241, 2390, 7224,
|
||||
5072, 2064, 4741, 1687, 6841, 482, 7441, 1235, 2126, 4742, 2802, 5744,
|
||||
6287, 4933, 699, 3604, 1297, 2127, 5857, 1705, 3868, 3779, 4397, 2177,
|
||||
159, 622, 2240, 1275, 640, 6948, 4572, 5277, 209, 2605, 1157, 7328,
|
||||
5817, 3191, 1662, 2009, 4864, 574, 2487, 164, 6197, 4436, 7257, 3462,
|
||||
4268, 4281, 3414, 4515, 3170, 1290, 2003, 5855, 7156, 6062, 7531, 1732,
|
||||
3249, 4884, 7512, 3590, 1049, 2123, 1397, 6093, 3691, 6130, 6541, 3946,
|
||||
6258, 3322, 1788, 4241, 4900, 2309, 1400, 1757, 400, 502, 6698, 2338,
|
||||
3011, 668, 7444, 4580, 6516, 6795, 2959, 4136, 3040, 2279, 6355, 3943,
|
||||
2913, 6613, 7416, 4084, 6508, 5556, 4054, 3782, 61, 6567, 2212, 779,
|
||||
632, 5709, 5667, 4923, 4911, 6893, 4695, 4164, 3536, 2287, 7594, 2848,
|
||||
3267, 1911, 3128, 546, 1991, 156, 4958, 5531, 6903, 483, 875, 138,
|
||||
250, 2234, 2266, 7222, 2842, 4258, 812, 6703, 232, 5207, 6650, 2585,
|
||||
1900, 6225, 4932, 7265, 4701, 3173, 4635, 6393, 227, 7313, 4454, 4284,
|
||||
6759, 1224, 5223, 1447, 395, 2608, 4502, 4037, 189, 3348, 54, 6443,
|
||||
2210, 6230, 2826, 1780, 3002, 5995, 1955, 6102, 6045, 3938, 5019, 4417,
|
||||
1434, 1262, 1507, 5847, 5917, 7157, 7177, 6434, 7537, 741, 4348, 1309,
|
||||
145, 374, 2236, 4496, 5028, 6771, 6923, 7421, 1978, 1023, 3857, 6876,
|
||||
1102, 7451, 4704, 6518, 1344, 765, 384, 5705, 1207, 1630, 4734, 1563,
|
||||
6839, 5933, 1954, 4987, 7142, 5814, 7527, 4953, 7637, 4707, 2182, 5734,
|
||||
2818, 541, 4097, 5641
|
||||
};
|
||||
70
src/kem/kyber/pqclean_kyber768_clean/reduce.c
Normal file
70
src/kem/kyber/pqclean_kyber768_clean/reduce.c
Normal file
@ -0,0 +1,70 @@
|
||||
#include "reduce.h"
|
||||
#include "params.h"
|
||||
|
||||
static const uint32_t qinv = 7679; // -inverse_mod(q,2^18)
|
||||
static const uint32_t rlog = 18;
|
||||
|
||||
/*************************************************
|
||||
* Name: montgomery_reduce
|
||||
*
|
||||
* Description: Montgomery reduction; given a 32-bit integer a, computes
|
||||
* 16-bit integer congruent to a * R^-1 mod q,
|
||||
* where R=2^18 (see value of rlog)
|
||||
*
|
||||
* Arguments: - uint32_t a: input unsigned integer to be reduced; has to be in
|
||||
*{0,...,2281446912}
|
||||
*
|
||||
* Returns: unsigned integer in {0,...,2^13-1} congruent to a * R^-1 modulo
|
||||
*q.
|
||||
**************************************************/
|
||||
uint16_t PQCLEAN_KYBER768_CLEAN_montgomery_reduce(uint32_t a) {
|
||||
uint32_t u;
|
||||
|
||||
u = (a * qinv);
|
||||
u &= ((1 << rlog) - 1);
|
||||
u *= KYBER_Q;
|
||||
a = a + u;
|
||||
return (uint16_t)(a >> rlog);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: barrett_reduce
|
||||
*
|
||||
* Description: Barrett reduction; given a 16-bit integer a, computes
|
||||
* 16-bit integer congruent to a mod q in {0,...,11768}
|
||||
*
|
||||
* Arguments: - uint16_t a: input unsigned integer to be reduced
|
||||
*
|
||||
* Returns: unsigned integer in {0,...,11768} congruent to a modulo q.
|
||||
**************************************************/
|
||||
uint16_t PQCLEAN_KYBER768_CLEAN_barrett_reduce(uint16_t a) {
|
||||
uint16_t u;
|
||||
|
||||
u = a >> 13; //((uint32_t) a * sinv) >> 16;
|
||||
u *= KYBER_Q;
|
||||
a -= u;
|
||||
return a;
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: freeze
|
||||
*
|
||||
* Description: Full reduction; given a 16-bit integer a, computes
|
||||
* unsigned integer a mod q.
|
||||
*
|
||||
* Arguments: - uint16_t x: input unsigned integer to be reduced
|
||||
*
|
||||
* Returns: unsigned integer in {0,...,q-1} congruent to a modulo q.
|
||||
**************************************************/
|
||||
uint16_t PQCLEAN_KYBER768_CLEAN_freeze(uint16_t x) {
|
||||
uint16_t m, r;
|
||||
int16_t c;
|
||||
r = PQCLEAN_KYBER768_CLEAN_barrett_reduce(x);
|
||||
|
||||
m = r - KYBER_Q;
|
||||
c = m;
|
||||
c >>= 15;
|
||||
r = m ^ ((r ^ m) & c);
|
||||
|
||||
return r;
|
||||
}
|
||||
12
src/kem/kyber/pqclean_kyber768_clean/reduce.h
Normal file
12
src/kem/kyber/pqclean_kyber768_clean/reduce.h
Normal file
@ -0,0 +1,12 @@
|
||||
#ifndef REDUCE_H
|
||||
#define REDUCE_H
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
uint16_t PQCLEAN_KYBER768_CLEAN_freeze(uint16_t x);
|
||||
|
||||
uint16_t PQCLEAN_KYBER768_CLEAN_montgomery_reduce(uint32_t a);
|
||||
|
||||
uint16_t PQCLEAN_KYBER768_CLEAN_barrett_reduce(uint16_t a);
|
||||
|
||||
#endif
|
||||
48
src/kem/kyber/pqclean_kyber768_clean/verify.c
Normal file
48
src/kem/kyber/pqclean_kyber768_clean/verify.c
Normal file
@ -0,0 +1,48 @@
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
|
||||
/*************************************************
|
||||
* Name: verify
|
||||
*
|
||||
* Description: Compare two arrays for equality in constant time.
|
||||
*
|
||||
* Arguments: const unsigned char *a: pointer to first byte array
|
||||
* const unsigned char *b: pointer to second byte array
|
||||
* size_t len: length of the byte arrays
|
||||
*
|
||||
* Returns 0 if the byte arrays are equal, 1 otherwise
|
||||
**************************************************/
|
||||
int PQCLEAN_KYBER768_CLEAN_verify(const unsigned char *a, const unsigned char *b, size_t len) {
|
||||
uint64_t r;
|
||||
size_t i;
|
||||
r = 0;
|
||||
|
||||
for (i = 0; i < len; i++) {
|
||||
r |= a[i] ^ b[i];
|
||||
}
|
||||
|
||||
r = (-(int64_t)r) >> 63;
|
||||
return (int)r;
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: cmov
|
||||
*
|
||||
* Description: Copy len bytes from x to r if b is 1;
|
||||
* don't modify x if b is 0. Requires b to be in {0,1};
|
||||
* assumes two's complement representation of negative integers.
|
||||
* Runs in constant time.
|
||||
*
|
||||
* Arguments: unsigned char *r: pointer to output byte array
|
||||
* const unsigned char *x: pointer to input byte array
|
||||
* size_t len: Amount of bytes to be copied
|
||||
* unsigned char b: Condition bit; has to be in {0,1}
|
||||
**************************************************/
|
||||
void PQCLEAN_KYBER768_CLEAN_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) {
|
||||
size_t i;
|
||||
|
||||
b = -b;
|
||||
for (i = 0; i < len; i++) {
|
||||
r[i] ^= b & (x[i] ^ r[i]);
|
||||
}
|
||||
}
|
||||
10
src/kem/kyber/pqclean_kyber768_clean/verify.h
Normal file
10
src/kem/kyber/pqclean_kyber768_clean/verify.h
Normal file
@ -0,0 +1,10 @@
|
||||
#ifndef VERIFY_H
|
||||
#define VERIFY_H
|
||||
|
||||
#include <stdio.h>
|
||||
|
||||
int PQCLEAN_KYBER768_CLEAN_verify(const unsigned char *a, const unsigned char *b, size_t len);
|
||||
|
||||
void PQCLEAN_KYBER768_CLEAN_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b);
|
||||
|
||||
#endif
|
||||
@ -1,15 +1,11 @@
|
||||
/* Kyber768 compilation file for Windows */
|
||||
|
||||
#define KYBER_K 3
|
||||
#define FUNC_PREFIX OQS_KEM_kyber_768_cca_kem
|
||||
|
||||
#include "functions_renaming.h"
|
||||
#include "ref/cbd.c"
|
||||
#include "ref/indcpa.c"
|
||||
#include "ref/kem.c"
|
||||
#include "ref/ntt.c"
|
||||
#include "ref/poly.c"
|
||||
#include "ref/polyvec.c"
|
||||
#include "ref/precomp.c"
|
||||
#include "ref/reduce.c"
|
||||
#include "ref/verify.c"
|
||||
#include "pqclean_kyber768_clean/cbd.c"
|
||||
#include "pqclean_kyber768_clean/indcpa.c"
|
||||
#include "pqclean_kyber768_clean/kem.c"
|
||||
#include "pqclean_kyber768_clean/ntt.c"
|
||||
#include "pqclean_kyber768_clean/poly.c"
|
||||
#include "pqclean_kyber768_clean/polyvec.c"
|
||||
#include "pqclean_kyber768_clean/precomp.c"
|
||||
#include "pqclean_kyber768_clean/reduce.c"
|
||||
#include "pqclean_kyber768_clean/verify.c"
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user