kris/pqc
1
1
Форк 0
Код Задачі Запити на злиття Релізи Вікі Активність

ntru: packaging script update. resolves #331

Переглянути джерело
This commit is contained in:
John M. Schanck 2020-10-05 14:09:11 -04:00
джерело 5eed5d3af1
коміт 0f148a6991
48 змінених файлів з 122 додано та 119 видалено
Показати статистику Завантажити патч Завантажити файл різниці Expand all files Collapse all files

4
crypto_kem/ntruhps2048509/META.yml
Переглянути файл

@ -23,9 +23,9 @@ auxiliary-submitters:
- Zhenfei Zhang
implementations:
- name: clean
version: https://github.com/jschanck/ntru/tree/ff3c84e1 reference implementation
version: https://github.com/jschanck/ntru/tree/b4b08d67 reference implementation
- name: avx2
version: https://github.com/jschanck/ntru/tree/ff3c84e1 avx2 implementation
version: https://github.com/jschanck/ntru/tree/b4b08d67 avx2 implementation
supported_platforms:
- architecture: x86_64
operating_systems:

4
crypto_kem/ntruhps2048509/avx2/crypto_sort_int32.c
Переглянути файл

@ -1,8 +1,8 @@
#include "crypto_sort_int32.h"
#include <immintrin.h>
// Based on supercop-20200820/crypto_sort/int32/avx2
#include "crypto_sort_int32.h"
#include <immintrin.h>
#define int32 int32_t
typedef __m256i int32x8;

3
crypto_kem/ntruhps2048509/avx2/crypto_sort_int32.h
Переглянути файл

@ -1,10 +1,11 @@
#ifndef CRYPTO_SORT
#define CRYPTO_SORT
#include "params.h"
#include <stddef.h>
#include <stdint.h>
void PQCLEAN_NTRUHPS2048509_AVX2_crypto_sort_int32(int32_t *x, size_t n);
#endif

7
crypto_kem/ntruhps2048509/avx2/kem.c
Переглянути файл

@ -42,12 +42,7 @@ int PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, con
uint8_t rm[NTRU_OWCPA_MSGBYTES];
uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES];
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= c[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
fail |= PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec(rm, c, sk);
fail = PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec(rm, c, sk);
/* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */
/* See comment in PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec for details. */

8
crypto_kem/ntruhps2048509/avx2/owcpa.c
Переглянути файл

@ -123,11 +123,15 @@ int PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec(unsigned char *rm,
PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_mul(m, mf, finv3);
PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m);
/* NOTE: For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */
/* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */
/* (m can take any value in S3 in NTRU_HRSS) */
fail = 0;
fail |= owcpa_check_m(m);
/* b = c - Lift(m) mod (q, x^n - 1) */

1
crypto_kem/ntruhps2048509/avx2/sample.c
Переглянути файл

@ -1,4 +1,3 @@
#include "crypto_sort_int32.h"
#include "sample.h"
void PQCLEAN_NTRUHPS2048509_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) {

2
crypto_kem/ntruhps2048509/avx2/sample.h
Переглянути файл

@ -4,6 +4,8 @@
#include "params.h"
#include "poly.h"
#include "crypto_sort_int32.h"
void PQCLEAN_NTRUHPS2048509_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]);
void PQCLEAN_NTRUHPS2048509_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]);

7
crypto_kem/ntruhps2048509/clean/kem.c
Переглянути файл

@ -42,12 +42,7 @@ int PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_dec(uint8_t *k, const uint8_t *c, co
uint8_t rm[NTRU_OWCPA_MSGBYTES];
uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES];
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= c[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
fail |= PQCLEAN_NTRUHPS2048509_CLEAN_owcpa_dec(rm, c, sk);
fail = PQCLEAN_NTRUHPS2048509_CLEAN_owcpa_dec(rm, c, sk);
/* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */
/* See comment in PQCLEAN_NTRUHPS2048509_CLEAN_owcpa_dec for details. */

8
crypto_kem/ntruhps2048509/clean/owcpa.c
Переглянути файл

@ -123,11 +123,15 @@ int PQCLEAN_NTRUHPS2048509_CLEAN_owcpa_dec(unsigned char *rm,
PQCLEAN_NTRUHPS2048509_CLEAN_poly_S3_mul(m, mf, finv3);
PQCLEAN_NTRUHPS2048509_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m);
/* NOTE: For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */
/* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */
/* (m can take any value in S3 in NTRU_HRSS) */
fail = 0;
fail |= owcpa_check_m(m);
/* b = c - Lift(m) mod (q, x^n - 1) */

8
crypto_kem/ntruhps2048509/clean/poly_r2_inv.c
Переглянути файл

@ -3,14 +3,14 @@
#include "poly.h"
/* return -1 if x<0 and y<0; otherwise return 0 */
static inline int both_negative_mask(int x, int y) {
static inline int16_t both_negative_mask(int16_t x, int16_t y) {
return (x & y) >> 15;
}
void PQCLEAN_NTRUHPS2048509_CLEAN_poly_R2_inv(poly *r, const poly *a) {
poly f, g, v, w;
int i, loop, delta;
int sign, swap, t;
int16_t i, loop, delta;
int16_t sign, swap, t;
for (i = 0; i < NTRU_N; ++i) {
v.coeffs[i] = 0;
@ -37,7 +37,7 @@ void PQCLEAN_NTRUHPS2048509_CLEAN_poly_R2_inv(poly *r, const poly *a) {
v.coeffs[0] = 0;
sign = g.coeffs[0] & f.coeffs[0];
swap = both_negative_mask(-delta, -(int) g.coeffs[0]);
swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]);
delta ^= swap & (delta ^ -delta);
delta += 1;

8
crypto_kem/ntruhps2048509/clean/poly_s3_inv.c
Переглянути файл

@ -11,14 +11,14 @@ static inline uint8_t mod3(uint8_t a) { /* a between 0 and 9 */
}
/* return -1 if x<0 and y<0; otherwise return 0 */
static inline int both_negative_mask(int x, int y) {
static inline int16_t both_negative_mask(int16_t x, int16_t y) {
return (x & y) >> 15;
}
void PQCLEAN_NTRUHPS2048509_CLEAN_poly_S3_inv(poly *r, const poly *a) {
poly f, g, v, w;
int i, loop, delta;
int sign, swap, t;
int16_t i, loop, delta;
int16_t sign, swap, t;
for (i = 0; i < NTRU_N; ++i) {
v.coeffs[i] = 0;
@ -45,7 +45,7 @@ void PQCLEAN_NTRUHPS2048509_CLEAN_poly_S3_inv(poly *r, const poly *a) {
v.coeffs[0] = 0;
sign = mod3((uint8_t) (2 * g.coeffs[0] * f.coeffs[0]));
swap = both_negative_mask(-delta, -(int) g.coeffs[0]);
swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]);
delta ^= swap & (delta ^ -delta);
delta += 1;

1
crypto_kem/ntruhps2048509/clean/sample.c
Переглянути файл

@ -1,4 +1,3 @@
#include "crypto_sort_int32.h"
#include "sample.h"
void PQCLEAN_NTRUHPS2048509_CLEAN_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) {

2
crypto_kem/ntruhps2048509/clean/sample.h
Переглянути файл

@ -4,6 +4,8 @@
#include "params.h"
#include "poly.h"
#include "crypto_sort_int32.h"
void PQCLEAN_NTRUHPS2048509_CLEAN_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]);
void PQCLEAN_NTRUHPS2048509_CLEAN_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]);

4
crypto_kem/ntruhps2048677/META.yml
Переглянути файл

@ -23,9 +23,9 @@ auxiliary-submitters:
- Zhenfei Zhang
implementations:
- name: clean
version: https://github.com/jschanck/ntru/tree/ff3c84e1 reference implementation
version: https://github.com/jschanck/ntru/tree/b4b08d67 reference implementation
- name: avx2
version: https://github.com/jschanck/ntru/tree/ff3c84e1 avx2 implementation
version: https://github.com/jschanck/ntru/tree/b4b08d67 avx2 implementation
supported_platforms:
- architecture: x86_64
operating_systems:

4
crypto_kem/ntruhps2048677/avx2/crypto_sort_int32.c
Переглянути файл

@ -1,8 +1,8 @@
#include "crypto_sort_int32.h"
#include <immintrin.h>
// Based on supercop-20200820/crypto_sort/int32/avx2
#include "crypto_sort_int32.h"
#include <immintrin.h>
#define int32 int32_t
typedef __m256i int32x8;

3
crypto_kem/ntruhps2048677/avx2/crypto_sort_int32.h
Переглянути файл

@ -1,10 +1,11 @@
#ifndef CRYPTO_SORT
#define CRYPTO_SORT
#include "params.h"
#include <stddef.h>
#include <stdint.h>
void PQCLEAN_NTRUHPS2048677_AVX2_crypto_sort_int32(int32_t *x, size_t n);
#endif

7
crypto_kem/ntruhps2048677/avx2/kem.c
Переглянути файл

@ -42,12 +42,7 @@ int PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, con
uint8_t rm[NTRU_OWCPA_MSGBYTES];
uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES];
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= c[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
fail |= PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec(rm, c, sk);
fail = PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec(rm, c, sk);
/* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */
/* See comment in PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec for details. */

8
crypto_kem/ntruhps2048677/avx2/owcpa.c
Переглянути файл

@ -123,11 +123,15 @@ int PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec(unsigned char *rm,
PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_mul(m, mf, finv3);
PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m);
/* NOTE: For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */
/* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */
/* (m can take any value in S3 in NTRU_HRSS) */
fail = 0;
fail |= owcpa_check_m(m);
/* b = c - Lift(m) mod (q, x^n - 1) */

1
crypto_kem/ntruhps2048677/avx2/sample.c
Переглянути файл

@ -1,4 +1,3 @@
#include "crypto_sort_int32.h"
#include "sample.h"
void PQCLEAN_NTRUHPS2048677_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) {

2
crypto_kem/ntruhps2048677/avx2/sample.h
Переглянути файл

@ -4,6 +4,8 @@
#include "params.h"
#include "poly.h"
#include "crypto_sort_int32.h"
void PQCLEAN_NTRUHPS2048677_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]);
void PQCLEAN_NTRUHPS2048677_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]);

7
crypto_kem/ntruhps2048677/clean/kem.c
Переглянути файл

@ -42,12 +42,7 @@ int PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_dec(uint8_t *k, const uint8_t *c, co
uint8_t rm[NTRU_OWCPA_MSGBYTES];
uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES];
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= c[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
fail |= PQCLEAN_NTRUHPS2048677_CLEAN_owcpa_dec(rm, c, sk);
fail = PQCLEAN_NTRUHPS2048677_CLEAN_owcpa_dec(rm, c, sk);
/* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */
/* See comment in PQCLEAN_NTRUHPS2048677_CLEAN_owcpa_dec for details. */

8
crypto_kem/ntruhps2048677/clean/owcpa.c
Переглянути файл

@ -123,11 +123,15 @@ int PQCLEAN_NTRUHPS2048677_CLEAN_owcpa_dec(unsigned char *rm,
PQCLEAN_NTRUHPS2048677_CLEAN_poly_S3_mul(m, mf, finv3);
PQCLEAN_NTRUHPS2048677_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m);
/* NOTE: For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */
/* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */
/* (m can take any value in S3 in NTRU_HRSS) */
fail = 0;
fail |= owcpa_check_m(m);
/* b = c - Lift(m) mod (q, x^n - 1) */

8
crypto_kem/ntruhps2048677/clean/poly_r2_inv.c
Переглянути файл

@ -3,14 +3,14 @@
#include "poly.h"
/* return -1 if x<0 and y<0; otherwise return 0 */
static inline int both_negative_mask(int x, int y) {
static inline int16_t both_negative_mask(int16_t x, int16_t y) {
return (x & y) >> 15;
}
void PQCLEAN_NTRUHPS2048677_CLEAN_poly_R2_inv(poly *r, const poly *a) {
poly f, g, v, w;
int i, loop, delta;
int sign, swap, t;
int16_t i, loop, delta;
int16_t sign, swap, t;
for (i = 0; i < NTRU_N; ++i) {
v.coeffs[i] = 0;
@ -37,7 +37,7 @@ void PQCLEAN_NTRUHPS2048677_CLEAN_poly_R2_inv(poly *r, const poly *a) {
v.coeffs[0] = 0;
sign = g.coeffs[0] & f.coeffs[0];
swap = both_negative_mask(-delta, -(int) g.coeffs[0]);
swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]);
delta ^= swap & (delta ^ -delta);
delta += 1;

8
crypto_kem/ntruhps2048677/clean/poly_s3_inv.c
Переглянути файл

@ -11,14 +11,14 @@ static inline uint8_t mod3(uint8_t a) { /* a between 0 and 9 */
}
/* return -1 if x<0 and y<0; otherwise return 0 */
static inline int both_negative_mask(int x, int y) {
static inline int16_t both_negative_mask(int16_t x, int16_t y) {
return (x & y) >> 15;
}
void PQCLEAN_NTRUHPS2048677_CLEAN_poly_S3_inv(poly *r, const poly *a) {
poly f, g, v, w;
int i, loop, delta;
int sign, swap, t;
int16_t i, loop, delta;
int16_t sign, swap, t;
for (i = 0; i < NTRU_N; ++i) {
v.coeffs[i] = 0;
@ -45,7 +45,7 @@ void PQCLEAN_NTRUHPS2048677_CLEAN_poly_S3_inv(poly *r, const poly *a) {
v.coeffs[0] = 0;
sign = mod3((uint8_t) (2 * g.coeffs[0] * f.coeffs[0]));
swap = both_negative_mask(-delta, -(int) g.coeffs[0]);
swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]);
delta ^= swap & (delta ^ -delta);
delta += 1;

1
crypto_kem/ntruhps2048677/clean/sample.c
Переглянути файл

@ -1,4 +1,3 @@
#include "crypto_sort_int32.h"
#include "sample.h"
void PQCLEAN_NTRUHPS2048677_CLEAN_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) {

2
crypto_kem/ntruhps2048677/clean/sample.h
Переглянути файл

@ -4,6 +4,8 @@
#include "params.h"
#include "poly.h"
#include "crypto_sort_int32.h"
void PQCLEAN_NTRUHPS2048677_CLEAN_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]);
void PQCLEAN_NTRUHPS2048677_CLEAN_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]);

4
crypto_kem/ntruhps4096821/META.yml
Переглянути файл

@ -23,9 +23,9 @@ auxiliary-submitters:
- Zhenfei Zhang
implementations:
- name: clean
version: https://github.com/jschanck/ntru/tree/ff3c84e1 reference implementation
version: https://github.com/jschanck/ntru/tree/b4b08d67 reference implementation
- name: avx2
version: https://github.com/jschanck/ntru/tree/ff3c84e1 avx2 implementation
version: https://github.com/jschanck/ntru/tree/b4b08d67 avx2 implementation
supported_platforms:
- architecture: x86_64
operating_systems:

4
crypto_kem/ntruhps4096821/avx2/crypto_sort_int32.c
Переглянути файл

@ -1,8 +1,8 @@
#include "crypto_sort_int32.h"
#include <immintrin.h>
// Based on supercop-20200820/crypto_sort/int32/avx2
#include "crypto_sort_int32.h"
#include <immintrin.h>
#define int32 int32_t
typedef __m256i int32x8;

3
crypto_kem/ntruhps4096821/avx2/crypto_sort_int32.h
Переглянути файл

@ -1,10 +1,11 @@
#ifndef CRYPTO_SORT
#define CRYPTO_SORT
#include "params.h"
#include <stddef.h>
#include <stdint.h>
void PQCLEAN_NTRUHPS4096821_AVX2_crypto_sort_int32(int32_t *x, size_t n);
#endif

7
crypto_kem/ntruhps4096821/avx2/kem.c
Переглянути файл

@ -42,12 +42,7 @@ int PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, con
uint8_t rm[NTRU_OWCPA_MSGBYTES];
uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES];
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= c[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
fail |= PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec(rm, c, sk);
fail = PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec(rm, c, sk);
/* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */
/* See comment in PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec for details. */

8
crypto_kem/ntruhps4096821/avx2/owcpa.c
Переглянути файл

@ -123,11 +123,15 @@ int PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec(unsigned char *rm,
PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_mul(m, mf, finv3);
PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m);
/* NOTE: For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */
/* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */
/* (m can take any value in S3 in NTRU_HRSS) */
fail = 0;
fail |= owcpa_check_m(m);
/* b = c - Lift(m) mod (q, x^n - 1) */

1
crypto_kem/ntruhps4096821/avx2/sample.c
Переглянути файл

@ -1,4 +1,3 @@
#include "crypto_sort_int32.h"
#include "sample.h"
void PQCLEAN_NTRUHPS4096821_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) {

2
crypto_kem/ntruhps4096821/avx2/sample.h
Переглянути файл

@ -4,6 +4,8 @@
#include "params.h"
#include "poly.h"
#include "crypto_sort_int32.h"
void PQCLEAN_NTRUHPS4096821_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]);
void PQCLEAN_NTRUHPS4096821_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]);

7
crypto_kem/ntruhps4096821/clean/kem.c
Переглянути файл

@ -42,12 +42,7 @@ int PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_dec(uint8_t *k, const uint8_t *c, co
uint8_t rm[NTRU_OWCPA_MSGBYTES];
uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES];
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= c[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
fail |= PQCLEAN_NTRUHPS4096821_CLEAN_owcpa_dec(rm, c, sk);
fail = PQCLEAN_NTRUHPS4096821_CLEAN_owcpa_dec(rm, c, sk);
/* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */
/* See comment in PQCLEAN_NTRUHPS4096821_CLEAN_owcpa_dec for details. */

8
crypto_kem/ntruhps4096821/clean/owcpa.c
Переглянути файл

@ -123,11 +123,15 @@ int PQCLEAN_NTRUHPS4096821_CLEAN_owcpa_dec(unsigned char *rm,
PQCLEAN_NTRUHPS4096821_CLEAN_poly_S3_mul(m, mf, finv3);
PQCLEAN_NTRUHPS4096821_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m);
/* NOTE: For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */
/* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */
/* (m can take any value in S3 in NTRU_HRSS) */
fail = 0;
fail |= owcpa_check_m(m);
/* b = c - Lift(m) mod (q, x^n - 1) */

8
crypto_kem/ntruhps4096821/clean/poly_r2_inv.c
Переглянути файл

@ -3,14 +3,14 @@
#include "poly.h"
/* return -1 if x<0 and y<0; otherwise return 0 */
static inline int both_negative_mask(int x, int y) {
static inline int16_t both_negative_mask(int16_t x, int16_t y) {
return (x & y) >> 15;
}
void PQCLEAN_NTRUHPS4096821_CLEAN_poly_R2_inv(poly *r, const poly *a) {
poly f, g, v, w;
int i, loop, delta;
int sign, swap, t;
int16_t i, loop, delta;
int16_t sign, swap, t;
for (i = 0; i < NTRU_N; ++i) {
v.coeffs[i] = 0;
@ -37,7 +37,7 @@ void PQCLEAN_NTRUHPS4096821_CLEAN_poly_R2_inv(poly *r, const poly *a) {
v.coeffs[0] = 0;
sign = g.coeffs[0] & f.coeffs[0];
swap = both_negative_mask(-delta, -(int) g.coeffs[0]);
swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]);
delta ^= swap & (delta ^ -delta);
delta += 1;

8
crypto_kem/ntruhps4096821/clean/poly_s3_inv.c
Переглянути файл

@ -11,14 +11,14 @@ static inline uint8_t mod3(uint8_t a) { /* a between 0 and 9 */
}
/* return -1 if x<0 and y<0; otherwise return 0 */
static inline int both_negative_mask(int x, int y) {
static inline int16_t both_negative_mask(int16_t x, int16_t y) {
return (x & y) >> 15;
}
void PQCLEAN_NTRUHPS4096821_CLEAN_poly_S3_inv(poly *r, const poly *a) {
poly f, g, v, w;
int i, loop, delta;
int sign, swap, t;
int16_t i, loop, delta;
int16_t sign, swap, t;
for (i = 0; i < NTRU_N; ++i) {
v.coeffs[i] = 0;
@ -45,7 +45,7 @@ void PQCLEAN_NTRUHPS4096821_CLEAN_poly_S3_inv(poly *r, const poly *a) {
v.coeffs[0] = 0;
sign = mod3((uint8_t) (2 * g.coeffs[0] * f.coeffs[0]));
swap = both_negative_mask(-delta, -(int) g.coeffs[0]);
swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]);
delta ^= swap & (delta ^ -delta);
delta += 1;

1
crypto_kem/ntruhps4096821/clean/sample.c
Переглянути файл

@ -1,4 +1,3 @@
#include "crypto_sort_int32.h"
#include "sample.h"
void PQCLEAN_NTRUHPS4096821_CLEAN_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) {

2
crypto_kem/ntruhps4096821/clean/sample.h
Переглянути файл

@ -4,6 +4,8 @@
#include "params.h"
#include "poly.h"
#include "crypto_sort_int32.h"
void PQCLEAN_NTRUHPS4096821_CLEAN_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]);
void PQCLEAN_NTRUHPS4096821_CLEAN_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]);

4
crypto_kem/ntruhrss701/META.yml
Переглянути файл

@ -23,9 +23,9 @@ auxiliary-submitters:
- Zhenfei Zhang
implementations:
- name: clean
version: https://github.com/jschanck/ntru/tree/ff3c84e1 reference implementation
version: https://github.com/jschanck/ntru/tree/b4b08d67 reference implementation
- name: avx2
version: https://github.com/jschanck/ntru/tree/ff3c84e1 avx2 implementation
version: https://github.com/jschanck/ntru/tree/b4b08d67 avx2 implementation
supported_platforms:
- architecture: x86_64
operating_systems:

7
crypto_kem/ntruhrss701/avx2/kem.c
Переглянути файл

@ -42,12 +42,7 @@ int PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, const
uint8_t rm[NTRU_OWCPA_MSGBYTES];
uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES];
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= c[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
fail |= PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec(rm, c, sk);
fail = PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec(rm, c, sk);
/* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */
/* See comment in PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec for details. */

8
crypto_kem/ntruhrss701/avx2/owcpa.c
Переглянути файл

@ -106,11 +106,15 @@ int PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec(unsigned char *rm,
PQCLEAN_NTRUHRSS701_AVX2_poly_S3_mul(m, mf, finv3);
PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m);
/* NOTE: For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */
/* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */
/* (m can take any value in S3 in NTRU_HRSS) */
fail = 0;
/* b = c - Lift(m) mod (q, x^n - 1) */
PQCLEAN_NTRUHRSS701_AVX2_poly_lift(liftm, m);

1
crypto_kem/ntruhrss701/avx2/sample.h
Переглянути файл

@ -4,6 +4,7 @@
#include "params.h"
#include "poly.h"
void PQCLEAN_NTRUHRSS701_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]);
void PQCLEAN_NTRUHRSS701_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]);

7
crypto_kem/ntruhrss701/clean/kem.c
Переглянути файл

@ -42,12 +42,7 @@ int PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_dec(uint8_t *k, const uint8_t *c, const
uint8_t rm[NTRU_OWCPA_MSGBYTES];
uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES];
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= c[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
fail |= PQCLEAN_NTRUHRSS701_CLEAN_owcpa_dec(rm, c, sk);
fail = PQCLEAN_NTRUHRSS701_CLEAN_owcpa_dec(rm, c, sk);
/* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */
/* See comment in PQCLEAN_NTRUHRSS701_CLEAN_owcpa_dec for details. */

8
crypto_kem/ntruhrss701/clean/owcpa.c
Переглянути файл

@ -106,11 +106,15 @@ int PQCLEAN_NTRUHRSS701_CLEAN_owcpa_dec(unsigned char *rm,
PQCLEAN_NTRUHRSS701_CLEAN_poly_S3_mul(m, mf, finv3);
PQCLEAN_NTRUHRSS701_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m);
/* NOTE: For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))));
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */
/* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */
/* (m can take any value in S3 in NTRU_HRSS) */
fail = 0;
/* b = c - Lift(m) mod (q, x^n - 1) */
PQCLEAN_NTRUHRSS701_CLEAN_poly_lift(liftm, m);

8
crypto_kem/ntruhrss701/clean/poly_r2_inv.c
Переглянути файл

@ -3,14 +3,14 @@
#include "poly.h"
/* return -1 if x<0 and y<0; otherwise return 0 */
static inline int both_negative_mask(int x, int y) {
static inline int16_t both_negative_mask(int16_t x, int16_t y) {
return (x & y) >> 15;
}
void PQCLEAN_NTRUHRSS701_CLEAN_poly_R2_inv(poly *r, const poly *a) {
poly f, g, v, w;
int i, loop, delta;
int sign, swap, t;
int16_t i, loop, delta;
int16_t sign, swap, t;
for (i = 0; i < NTRU_N; ++i) {
v.coeffs[i] = 0;
@ -37,7 +37,7 @@ void PQCLEAN_NTRUHRSS701_CLEAN_poly_R2_inv(poly *r, const poly *a) {
v.coeffs[0] = 0;
sign = g.coeffs[0] & f.coeffs[0];
swap = both_negative_mask(-delta, -(int) g.coeffs[0]);
swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]);
delta ^= swap & (delta ^ -delta);
delta += 1;

8
crypto_kem/ntruhrss701/clean/poly_s3_inv.c
Переглянути файл

@ -11,14 +11,14 @@ static inline uint8_t mod3(uint8_t a) { /* a between 0 and 9 */
}
/* return -1 if x<0 and y<0; otherwise return 0 */
static inline int both_negative_mask(int x, int y) {
static inline int16_t both_negative_mask(int16_t x, int16_t y) {
return (x & y) >> 15;
}
void PQCLEAN_NTRUHRSS701_CLEAN_poly_S3_inv(poly *r, const poly *a) {
poly f, g, v, w;
int i, loop, delta;
int sign, swap, t;
int16_t i, loop, delta;
int16_t sign, swap, t;
for (i = 0; i < NTRU_N; ++i) {
v.coeffs[i] = 0;
@ -45,7 +45,7 @@ void PQCLEAN_NTRUHRSS701_CLEAN_poly_S3_inv(poly *r, const poly *a) {
v.coeffs[0] = 0;
sign = mod3((uint8_t) (2 * g.coeffs[0] * f.coeffs[0]));
swap = both_negative_mask(-delta, -(int) g.coeffs[0]);
swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]);
delta ^= swap & (delta ^ -delta);
delta += 1;

1
crypto_kem/ntruhrss701/clean/sample.h
Переглянути файл

@ -4,6 +4,7 @@
#include "params.h"
#include "poly.h"
void PQCLEAN_NTRUHRSS701_CLEAN_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]);
void PQCLEAN_NTRUHRSS701_CLEAN_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]);