diff --git a/crypto_kem/frodokem640shake/clean/common.h b/crypto_kem/frodokem640shake/clean/common.h index 03f73da8..9eeccdec 100644 --- a/crypto_kem/frodokem640shake/clean/common.h +++ b/crypto_kem/frodokem640shake/clean/common.h @@ -4,7 +4,7 @@ int PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_add_as_plus_e(uint16_t *out, const uint16_t *s, const uint16_t *e, const uint8_t *seed_A); int PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_add_sa_plus_e(uint16_t *out, const uint16_t *s, const uint16_t *e, const uint8_t *seed_A); void PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(uint16_t *s, const size_t n); -void PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_bs(uint16_t *out, const uint16_t *b, const uint16_t *s); +void PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_bs(uint16_t *out, const uint16_t *b, const uint16_t *s); void PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_add_sb_plus_e(uint16_t *out, const uint16_t *b, const uint16_t *s, const uint16_t *e); void PQCLEAN_FRODOKEM640SHAKE_CLEAN_add(uint16_t *out, const uint16_t *a, const uint16_t *b); void PQCLEAN_FRODOKEM640SHAKE_CLEAN_sub(uint16_t *out, const uint16_t *a, const uint16_t *b); diff --git a/crypto_kem/frodokem640shake/clean/kem.c b/crypto_kem/frodokem640shake/clean/kem.c index e1eb8d83..cb50c3ac 100644 --- a/crypto_kem/frodokem640shake/clean/kem.c +++ b/crypto_kem/frodokem640shake/clean/kem.c @@ -14,23 +14,23 @@ #include "params.h" #include "common.h" -int PQCLEAN_FRODOKEM640SHAKE_CLEAN_crypto_kem_keypair(unsigned char* pk, unsigned char* sk) -{ // FrodoKEM's key generation - // Outputs: public key pk ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) - // secret key sk (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) +int PQCLEAN_FRODOKEM640SHAKE_CLEAN_crypto_kem_keypair(unsigned char *pk, unsigned char *sk) { + // FrodoKEM's key generation + // Outputs: public key pk ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) + // secret key sk (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) uint8_t *pk_seedA = &pk[0]; uint8_t *pk_b = &pk[BYTES_SEED_A]; uint8_t *sk_s = &sk[0]; uint8_t *sk_pk = &sk[CRYPTO_BYTES]; uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; - uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; - uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; - uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data - uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data - uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE + uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2 * PARAMS_N * PARAMS_NBAR]; + uint16_t B[PARAMS_N * PARAMS_NBAR] = {0}; + uint16_t S[2 * PARAMS_N * PARAMS_NBAR] = {0}; // contains secret data + uint16_t *E = (uint16_t *)&S[PARAMS_N * PARAMS_NBAR]; // contains secret data + uint8_t randomness[2 * CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE uint8_t *randomness_s = &randomness[0]; // contains secret data uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data - uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; + uint8_t *randomness_z = &randomness[2 * CRYPTO_BYTES]; uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key @@ -40,48 +40,48 @@ int PQCLEAN_FRODOKEM640SHAKE_CLEAN_crypto_kem_keypair(unsigned char* pk, unsigne // Generate S and E, and compute B = A*S + E. Generate A on-the-fly shake_input_seedSE[0] = 0x5F; memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); - shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(S, PARAMS_N*PARAMS_NBAR); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(E, PARAMS_N*PARAMS_NBAR); + shake((uint8_t *)S, 2 * PARAMS_N * PARAMS_NBAR * sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(S, PARAMS_N * PARAMS_NBAR); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(E, PARAMS_N * PARAMS_NBAR); PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_add_as_plus_e(B, S, E, pk); // Encode the second part of the public key - PQCLEAN_FRODOKEM640SHAKE_CLEAN_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N * PARAMS_NBAR, PARAMS_LOGQ); // Add s, pk and S to the secret key memcpy(sk_s, randomness_s, CRYPTO_BYTES); memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); - memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); + memcpy(sk_S, S, 2 * PARAMS_N * PARAMS_NBAR); // Add H(pk) to the secret key shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); // Cleanup: - PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(randomness, 2*CRYPTO_BYTES); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)S, PARAMS_N * PARAMS_NBAR * sizeof(uint16_t)); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)E, PARAMS_N * PARAMS_NBAR * sizeof(uint16_t)); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(randomness, 2 * CRYPTO_BYTES); PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); return 0; } -int PQCLEAN_FRODOKEM640SHAKE_CLEAN_crypto_kem_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk) -{ // FrodoKEM's key encapsulation +int PQCLEAN_FRODOKEM640SHAKE_CLEAN_crypto_kem_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk) { + // FrodoKEM's key encapsulation const uint8_t *pk_seedA = &pk[0]; const uint8_t *pk_b = &pk[BYTES_SEED_A]; uint8_t *ct_c1 = &ct[0]; - uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; - uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; - uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data - uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; - uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; - uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] = {0}; // contains secret data - uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data - uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data + uint8_t *ct_c2 = &ct[(PARAMS_LOGQ * PARAMS_N * PARAMS_NBAR) / 8]; + uint16_t B[PARAMS_N * PARAMS_NBAR] = {0}; + uint16_t V[PARAMS_NBAR * PARAMS_NBAR] = {0}; // contains secret data + uint16_t C[PARAMS_NBAR * PARAMS_NBAR] = {0}; + uint16_t Bp[PARAMS_N * PARAMS_NBAR] = {0}; + uint16_t Sp[(2 * PARAMS_N + PARAMS_NBAR)*PARAMS_NBAR] = {0}; // contains secret data + uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N * PARAMS_NBAR]; // contains secret data + uint16_t *Epp = (uint16_t *)&Sp[2 * PARAMS_N * PARAMS_NBAR]; // contains secret data uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu uint8_t *pkh = &G2in[0]; uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data - uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data + uint8_t G2out[2 * CRYPTO_BYTES]; // contains secret data uint8_t *seedSE = &G2out[0]; // contains secret data uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k @@ -97,21 +97,21 @@ int PQCLEAN_FRODOKEM640SHAKE_CLEAN_crypto_kem_enc(unsigned char *ct, unsigned ch // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly shake_input_seedSE[0] = 0x96; memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); - shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(Sp, PARAMS_N*PARAMS_NBAR); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(Ep, PARAMS_N*PARAMS_NBAR); + shake((uint8_t *)Sp, (2 * PARAMS_N + PARAMS_NBAR)*PARAMS_NBAR * sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(Sp, PARAMS_N * PARAMS_NBAR); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(Ep, PARAMS_N * PARAMS_NBAR); PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_pack(ct_c1, (PARAMS_LOGQ * PARAMS_N * PARAMS_NBAR) / 8, Bp, PARAMS_N * PARAMS_NBAR, PARAMS_LOGQ); // Generate Epp, and compute V = Sp*B + Epp - PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(Epp, PARAMS_NBAR * PARAMS_NBAR); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_unpack(B, PARAMS_N * PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_add_sb_plus_e(V, B, Sp, Epp); // Encode mu, and compute C = V + enc(mu) (mod q) - PQCLEAN_FRODOKEM640SHAKE_CLEAN_key_encode(C, (uint16_t*)mu); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_key_encode(C, (uint16_t *)mu); PQCLEAN_FRODOKEM640SHAKE_CLEAN_add(C, V, C); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_pack(ct_c2, (PARAMS_LOGQ * PARAMS_NBAR * PARAMS_NBAR) / 8, C, PARAMS_NBAR * PARAMS_NBAR, PARAMS_LOGQ); // Compute ss = F(ct||KK) memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); @@ -119,41 +119,41 @@ int PQCLEAN_FRODOKEM640SHAKE_CLEAN_crypto_kem_enc(unsigned char *ct, unsigned ch shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); // Cleanup: - PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)V, PARAMS_NBAR * PARAMS_NBAR * sizeof(uint16_t)); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)Sp, PARAMS_N * PARAMS_NBAR * sizeof(uint16_t)); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)Ep, PARAMS_N * PARAMS_NBAR * sizeof(uint16_t)); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)Epp, PARAMS_NBAR * PARAMS_NBAR * sizeof(uint16_t)); PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(mu, BYTES_MU); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(G2out, 2*CRYPTO_BYTES); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(G2out, 2 * CRYPTO_BYTES); PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(Fin_k, CRYPTO_BYTES); PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); return 0; } -int PQCLEAN_FRODOKEM640SHAKE_CLEAN_crypto_kem_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk) -{ // FrodoKEM's key decapsulation - uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; - uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; - uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data - uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; - uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; - uint16_t BBp[PARAMS_N*PARAMS_NBAR] = {0}; - uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] = {0}; // contains secret data - uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data - uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data +int PQCLEAN_FRODOKEM640SHAKE_CLEAN_crypto_kem_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk) { + // FrodoKEM's key decapsulation + uint16_t B[PARAMS_N * PARAMS_NBAR] = {0}; + uint16_t Bp[PARAMS_N * PARAMS_NBAR] = {0}; + uint16_t W[PARAMS_NBAR * PARAMS_NBAR] = {0}; // contains secret data + uint16_t C[PARAMS_NBAR * PARAMS_NBAR] = {0}; + uint16_t CC[PARAMS_NBAR * PARAMS_NBAR] = {0}; + uint16_t BBp[PARAMS_N * PARAMS_NBAR] = {0}; + uint16_t Sp[(2 * PARAMS_N + PARAMS_NBAR)*PARAMS_NBAR] = {0}; // contains secret data + uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N * PARAMS_NBAR]; // contains secret data + uint16_t *Epp = (uint16_t *)&Sp[2 * PARAMS_N * PARAMS_NBAR]; // contains secret data const uint8_t *ct_c1 = &ct[0]; - const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; + const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ * PARAMS_N * PARAMS_NBAR) / 8]; const uint8_t *sk_s = &sk[0]; const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; - const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; + const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2 * PARAMS_N * PARAMS_NBAR]; const uint8_t *pk_seedA = &sk_pk[0]; const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime uint8_t *pkh = &G2in[0]; uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data - uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data + uint8_t G2out[2 * CRYPTO_BYTES]; // contains secret data uint8_t *seedSEprime = &G2out[0]; // contains secret data uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k @@ -162,11 +162,11 @@ int PQCLEAN_FRODOKEM640SHAKE_CLEAN_crypto_kem_dec(unsigned char *ss, const unsig uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data // Compute W = C - Bp*S (mod q), and decode the randomness mu - PQCLEAN_FRODOKEM640SHAKE_CLEAN_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_unpack(Bp, PARAMS_N * PARAMS_NBAR, ct_c1, (PARAMS_LOGQ * PARAMS_N * PARAMS_NBAR) / 8, PARAMS_LOGQ); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_unpack(C, PARAMS_NBAR * PARAMS_NBAR, ct_c2, (PARAMS_LOGQ * PARAMS_NBAR * PARAMS_NBAR) / 8, PARAMS_LOGQ); PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_bs(W, Bp, sk_S); PQCLEAN_FRODOKEM640SHAKE_CLEAN_sub(W, C, W); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_key_decode((uint16_t*)muprime, W); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_key_decode((uint16_t *)muprime, W); // Generate (seedSE' || k') = G_2(pkh || mu') memcpy(pkh, sk_pkh, BYTES_PKHASH); @@ -175,28 +175,30 @@ int PQCLEAN_FRODOKEM640SHAKE_CLEAN_crypto_kem_dec(unsigned char *ss, const unsig // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly shake_input_seedSEprime[0] = 0x96; memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); - shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(Sp, PARAMS_N*PARAMS_NBAR); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(Ep, PARAMS_N*PARAMS_NBAR); + shake((uint8_t *)Sp, (2 * PARAMS_N + PARAMS_NBAR)*PARAMS_NBAR * sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(Sp, PARAMS_N * PARAMS_NBAR); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(Ep, PARAMS_N * PARAMS_NBAR); PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); // Generate Epp, and compute W = Sp*B + Epp - PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(Epp, PARAMS_NBAR * PARAMS_NBAR); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_unpack(B, PARAMS_N * PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_add_sb_plus_e(W, B, Sp, Epp); // Encode mu, and compute CC = W + enc(mu') (mod q) - PQCLEAN_FRODOKEM640SHAKE_CLEAN_key_encode(CC, (uint16_t*)muprime); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_key_encode(CC, (uint16_t *)muprime); PQCLEAN_FRODOKEM640SHAKE_CLEAN_add(CC, W, CC); // Prepare input to F memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); // Reducing BBp modulo q - for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); + for (int i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { + BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ) - 1); + } // Is (Bp == BBp & C == CC) = true - if (memcmp(Bp, BBp, 2*PARAMS_N*PARAMS_NBAR) == 0 && memcmp(C, CC, 2*PARAMS_NBAR*PARAMS_NBAR) == 0) { + if (memcmp(Bp, BBp, 2 * PARAMS_N * PARAMS_NBAR) == 0 && memcmp(C, CC, 2 * PARAMS_NBAR * PARAMS_NBAR) == 0) { // Load k' to do ss = F(ct || k') memcpy(Fin_k, kprime, CRYPTO_BYTES); } else { @@ -206,12 +208,12 @@ int PQCLEAN_FRODOKEM640SHAKE_CLEAN_crypto_kem_dec(unsigned char *ss, const unsig shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); // Cleanup: - PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)W, PARAMS_NBAR * PARAMS_NBAR * sizeof(uint16_t)); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)Sp, PARAMS_N * PARAMS_NBAR * sizeof(uint16_t)); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)Ep, PARAMS_N * PARAMS_NBAR * sizeof(uint16_t)); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes((uint8_t *)Epp, PARAMS_NBAR * PARAMS_NBAR * sizeof(uint16_t)); PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(muprime, BYTES_MU); - PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(G2out, 2*CRYPTO_BYTES); + PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(G2out, 2 * CRYPTO_BYTES); PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(Fin_k, CRYPTO_BYTES); PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); return 0; diff --git a/crypto_kem/frodokem640shake/clean/matrix_shake.c b/crypto_kem/frodokem640shake/clean/matrix_shake.c index d81eb8d5..43fe3e9b 100644 --- a/crypto_kem/frodokem640shake/clean/matrix_shake.c +++ b/crypto_kem/frodokem640shake/clean/matrix_shake.c @@ -12,61 +12,61 @@ #include "api.h" #include "params.h" -int PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_add_as_plus_e(uint16_t *out, const uint16_t *s, const uint16_t *e, const uint8_t *seed_A) -{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. - // Inputs: s, e (N x N_BAR) - // Output: out = A*s + e (N x N_BAR) +int PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_add_as_plus_e(uint16_t *out, const uint16_t *s, const uint16_t *e, const uint8_t *seed_A) { + // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. + // Inputs: s, e (N x N_BAR) + // Output: out = A*s + e (N x N_BAR) int i, j, k; - int16_t A[PARAMS_N * PARAMS_N] = {0}; - + int16_t A[PARAMS_N * PARAMS_N] = {0}; + uint8_t seed_A_separated[2 + BYTES_SEED_A]; - uint16_t* seed_A_origin = (uint16_t*)&seed_A_separated; + uint16_t *seed_A_origin = (uint16_t *)&seed_A_separated; memcpy(&seed_A_separated[2], seed_A, BYTES_SEED_A); for (i = 0; i < PARAMS_N; i++) { seed_A_origin[0] = (uint16_t) i; - shake128((unsigned char*)(A + i*PARAMS_N), (unsigned long long)(2*PARAMS_N), seed_A_separated, 2 + BYTES_SEED_A); - } - memcpy(out, e, PARAMS_NBAR * PARAMS_N * sizeof(uint16_t)); - - for (i = 0; i < PARAMS_N; i++) { // Matrix multiplication-addition A*s + e - for (k = 0; k < PARAMS_NBAR; k++) { - uint16_t sum = 0; - for (j = 0; j < PARAMS_N; j++) { - sum += A[i*PARAMS_N + j] * s[k*PARAMS_N + j]; - } - out[i*PARAMS_NBAR + k] += sum; // Adding e. No need to reduce modulo 2^15, extra bits are taken care of during packing later on. - } - } - - return 1; -} - - -int PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_add_sa_plus_e(uint16_t *out, const uint16_t *s, const uint16_t *e, const uint8_t *seed_A) -{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. - // Inputs: s', e' (N_BAR x N) - // Output: out = s'*A + e' (N_BAR x N) - int i, j, k; - int16_t A[PARAMS_N * PARAMS_N] = {0}; - - uint8_t seed_A_separated[2 + BYTES_SEED_A]; - uint16_t* seed_A_origin = (uint16_t*)&seed_A_separated; - memcpy(&seed_A_separated[2], seed_A, BYTES_SEED_A); - for (i = 0; i < PARAMS_N; i++) { - seed_A_origin[0] = (uint16_t) i; - shake128((unsigned char*)(A + i*PARAMS_N), (unsigned long long)(2*PARAMS_N), seed_A_separated, 2 + BYTES_SEED_A); + shake128((unsigned char *)(A + i * PARAMS_N), (unsigned long long)(2 * PARAMS_N), seed_A_separated, 2 + BYTES_SEED_A); } memcpy(out, e, PARAMS_NBAR * PARAMS_N * sizeof(uint16_t)); for (i = 0; i < PARAMS_N; i++) { // Matrix multiplication-addition A*s + e for (k = 0; k < PARAMS_NBAR; k++) { uint16_t sum = 0; - for (j = 0; j < PARAMS_N; j++) { - sum += A[j*PARAMS_N + i] * s[k*PARAMS_N + j]; + for (j = 0; j < PARAMS_N; j++) { + sum += A[i * PARAMS_N + j] * s[k * PARAMS_N + j]; } - out[k*PARAMS_N + i] += sum; // Adding e. No need to reduce modulo 2^15, extra bits are taken care of during packing later on. + out[i * PARAMS_NBAR + k] += sum; // Adding e. No need to reduce modulo 2^15, extra bits are taken care of during packing later on. } } - + + return 1; +} + + +int PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_add_sa_plus_e(uint16_t *out, const uint16_t *s, const uint16_t *e, const uint8_t *seed_A) { + // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. + // Inputs: s', e' (N_BAR x N) + // Output: out = s'*A + e' (N_BAR x N) + int i, j, k; + int16_t A[PARAMS_N * PARAMS_N] = {0}; + + uint8_t seed_A_separated[2 + BYTES_SEED_A]; + uint16_t *seed_A_origin = (uint16_t *)&seed_A_separated; + memcpy(&seed_A_separated[2], seed_A, BYTES_SEED_A); + for (i = 0; i < PARAMS_N; i++) { + seed_A_origin[0] = (uint16_t) i; + shake128((unsigned char *)(A + i * PARAMS_N), (unsigned long long)(2 * PARAMS_N), seed_A_separated, 2 + BYTES_SEED_A); + } + memcpy(out, e, PARAMS_NBAR * PARAMS_N * sizeof(uint16_t)); + + for (i = 0; i < PARAMS_N; i++) { // Matrix multiplication-addition A*s + e + for (k = 0; k < PARAMS_NBAR; k++) { + uint16_t sum = 0; + for (j = 0; j < PARAMS_N; j++) { + sum += A[j * PARAMS_N + i] * s[k * PARAMS_N + j]; + } + out[k * PARAMS_N + i] += sum; // Adding e. No need to reduce modulo 2^15, extra bits are taken care of during packing later on. + } + } + return 1; } diff --git a/crypto_kem/frodokem640shake/clean/noise.c b/crypto_kem/frodokem640shake/clean/noise.c index f2cc96b8..66919a37 100644 --- a/crypto_kem/frodokem640shake/clean/noise.c +++ b/crypto_kem/frodokem640shake/clean/noise.c @@ -11,10 +11,10 @@ static uint16_t CDF_TABLE[CDF_TABLE_LEN] = CDF_TABLE_DATA; -void PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(uint16_t *s, const size_t n) -{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. - // The distribution is specified by its CDF. - // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. +void PQCLEAN_FRODOKEM640SHAKE_CLEAN_sample_n(uint16_t *s, const size_t n) { + // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. + // The distribution is specified by its CDF. + // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. unsigned int i, j; for (i = 0; i < n; ++i) { diff --git a/crypto_kem/frodokem640shake/clean/util.c b/crypto_kem/frodokem640shake/clean/util.c index 2f13887f..9ecb43e1 100644 --- a/crypto_kem/frodokem640shake/clean/util.c +++ b/crypto_kem/frodokem640shake/clean/util.c @@ -13,77 +13,78 @@ #define min(x, y) (((x) < (y)) ? (x) : (y)) -void PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_bs(uint16_t *out, const uint16_t *b, const uint16_t *s) -{ // Multiply by s on the right - // Inputs: b (N_BAR x N), s (N x N_BAR) - // Output: out = b*s (N_BAR x N_BAR) +void PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_bs(uint16_t *out, const uint16_t *b, const uint16_t *s) { + // Multiply by s on the right + // Inputs: b (N_BAR x N), s (N x N_BAR) + // Output: out = b*s (N_BAR x N_BAR) int i, j, k; for (i = 0; i < PARAMS_NBAR; i++) { for (j = 0; j < PARAMS_NBAR; j++) { - out[i*PARAMS_NBAR + j] = 0; + out[i * PARAMS_NBAR + j] = 0; for (k = 0; k < PARAMS_N; k++) { - out[i*PARAMS_NBAR + j] += b[i*PARAMS_N + k] * s[j*PARAMS_N + k]; + out[i * PARAMS_NBAR + j] += b[i * PARAMS_N + k] * s[j * PARAMS_N + k]; } - out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; pos++; } @@ -91,12 +92,12 @@ void PQCLEAN_FRODOKEM640SHAKE_CLEAN_key_encode(uint16_t *out, const uint16_t *in } -void PQCLEAN_FRODOKEM640SHAKE_CLEAN_key_decode(uint16_t *out, const uint16_t *in) -{ // Decoding +void PQCLEAN_FRODOKEM640SHAKE_CLEAN_key_decode(uint16_t *out, const uint16_t *in) { + // Decoding unsigned int i, j, index = 0, npieces_word = 8; unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; - uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; - uint8_t *pos = (uint8_t*)out; + uint16_t temp, maskex = ((uint16_t)1 << PARAMS_EXTRACTED_BITS) - 1, maskq = ((uint16_t)1 << PARAMS_LOGQ) - 1; + uint8_t *pos = (uint8_t *)out; uint64_t templong; for (i = 0; i < nwords; i++) { @@ -106,15 +107,16 @@ void PQCLEAN_FRODOKEM640SHAKE_CLEAN_key_decode(uint16_t *out, const uint16_t *in templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); index++; } - for(j = 0; j < PARAMS_EXTRACTED_BITS; j++) - pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; + for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { + pos[i * PARAMS_EXTRACTED_BITS + j] = (templong >> (8 * j)) & 0xFF; + } } } -void PQCLEAN_FRODOKEM640SHAKE_CLEAN_pack(unsigned char *out, const size_t outlen, const uint16_t *in, const size_t inlen, const unsigned char lsb) -{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. - // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. +void PQCLEAN_FRODOKEM640SHAKE_CLEAN_pack(unsigned char *out, const size_t outlen, const uint16_t *in, const size_t inlen, const unsigned char lsb) { + // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. + // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. memset(out, 0, outlen); size_t i = 0; // whole bytes already filled in @@ -161,9 +163,9 @@ void PQCLEAN_FRODOKEM640SHAKE_CLEAN_pack(unsigned char *out, const size_t outlen } -void PQCLEAN_FRODOKEM640SHAKE_CLEAN_unpack(uint16_t *out, const size_t outlen, const unsigned char *in, const size_t inlen, const unsigned char lsb) -{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits - // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). +void PQCLEAN_FRODOKEM640SHAKE_CLEAN_unpack(uint16_t *out, const size_t outlen, const unsigned char *in, const size_t inlen, const unsigned char lsb) { + // Unpack the input char vector into a uint16_t output vector, copying lsb bits + // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). memset(out, 0, outlen * sizeof(uint16_t)); size_t i = 0; // whole uint16_t already filled in @@ -210,10 +212,10 @@ void PQCLEAN_FRODOKEM640SHAKE_CLEAN_unpack(uint16_t *out, const size_t outlen, c } -void PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(uint8_t *mem, size_t n) -{ // Clear 8-bit bytes from memory. "n" indicates the number of bytes to be zeroed. - // This function uses the volatile type qualifier to inform the compiler not to optimize out the memory clearing. - volatile uint8_t *v = mem; +void PQCLEAN_FRODOKEM640SHAKE_CLEAN_clear_bytes(uint8_t *mem, size_t n) { + // Clear 8-bit bytes from memory. "n" indicates the number of bytes to be zeroed. + // This function uses the volatile type qualifier to inform the compiler not to optimize out the memory clearing. + volatile uint8_t *v = mem; for (size_t i = 0; i < n; i++) { v[i] = 0;