From 9dd4a4b5dad55f8608c0588aa99d27b263eedd64 Mon Sep 17 00:00:00 2001 From: Leon Botros Date: Sat, 24 Aug 2019 15:48:38 +0200 Subject: [PATCH] fix requested changes --- .../leaktime/H_Q_matrices_generation.c | 46 ++++--- crypto_kem/ledakemlt12/leaktime/bf_decoding.c | 45 +++---- crypto_kem/ledakemlt12/leaktime/dfr_test.c | 36 +++--- crypto_kem/ledakemlt12/leaktime/gf2x_arith.c | 2 +- .../leaktime/gf2x_arith_mod_xPplusOne.c | 112 +++++++++--------- .../leaktime/gf2x_arith_mod_xPplusOne.h | 16 +-- crypto_kem/ledakemlt12/leaktime/kem.c | 15 +-- .../ledakemlt12/leaktime/niederreiter.c | 50 ++++---- crypto_kem/ledakemlt12/leaktime/rng.c | 12 +- crypto_kem/ledakemlt12/leaktime/sort.c | 11 ++ crypto_kem/ledakemlt12/leaktime/sort.h | 11 -- .../leaktime/H_Q_matrices_generation.c | 46 ++++--- crypto_kem/ledakemlt32/leaktime/bf_decoding.c | 45 +++---- crypto_kem/ledakemlt32/leaktime/dfr_test.c | 36 +++--- crypto_kem/ledakemlt32/leaktime/gf2x_arith.c | 2 +- .../leaktime/gf2x_arith_mod_xPplusOne.c | 112 +++++++++--------- .../leaktime/gf2x_arith_mod_xPplusOne.h | 16 +-- crypto_kem/ledakemlt32/leaktime/kem.c | 15 +-- .../ledakemlt32/leaktime/niederreiter.c | 50 ++++---- crypto_kem/ledakemlt32/leaktime/rng.c | 12 +- crypto_kem/ledakemlt32/leaktime/sort.c | 11 ++ crypto_kem/ledakemlt32/leaktime/sort.h | 11 -- .../leaktime/H_Q_matrices_generation.c | 46 ++++--- crypto_kem/ledakemlt52/leaktime/bf_decoding.c | 45 +++---- crypto_kem/ledakemlt52/leaktime/dfr_test.c | 36 +++--- crypto_kem/ledakemlt52/leaktime/gf2x_arith.c | 2 +- .../leaktime/gf2x_arith_mod_xPplusOne.c | 112 +++++++++--------- .../leaktime/gf2x_arith_mod_xPplusOne.h | 16 +-- crypto_kem/ledakemlt52/leaktime/kem.c | 15 +-- .../ledakemlt52/leaktime/niederreiter.c | 50 ++++---- crypto_kem/ledakemlt52/leaktime/rng.c | 12 +- crypto_kem/ledakemlt52/leaktime/sort.c | 11 ++ crypto_kem/ledakemlt52/leaktime/sort.h | 11 -- .../ledakemlt12_leaktime.yml | 3 +- .../ledakemlt32_leaktime.yml | 3 +- .../ledakemlt52_leaktime.yml | 2 +- 36 files changed, 544 insertions(+), 532 deletions(-) diff --git a/crypto_kem/ledakemlt12/leaktime/H_Q_matrices_generation.c b/crypto_kem/ledakemlt12/leaktime/H_Q_matrices_generation.c index 93702434..14149d27 100644 --- a/crypto_kem/ledakemlt12/leaktime/H_Q_matrices_generation.c +++ b/crypto_kem/ledakemlt12/leaktime/H_Q_matrices_generation.c @@ -1,23 +1,19 @@ #include "H_Q_matrices_generation.h" #include "gf2x_arith_mod_xPplusOne.h" -void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], - AES_XOF_struct *keys_expander) { - - for (int i = 0; i < N0; i++) { +void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], AES_XOF_struct *keys_expander) { + for (size_t i = 0; i < N0; i++) { /* Generate a random block of Htr */ - PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], - DV, - keys_expander); + PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], DV, keys_expander); } } -void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], - AES_XOF_struct *keys_expander) { +void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], AES_XOF_struct *keys_expander) { + size_t placed_ones; - for (int i = 0; i < N0; i++) { - int placed_ones = 0; - for (int j = 0; j < N0; j++) { + for (size_t i = 0; i < N0; i++) { + placed_ones = 0; + for (size_t j = 0; j < N0; j++) { PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones], qBlockWeights[i][j], keys_expander); @@ -26,29 +22,27 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], } } -void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], /* output*/ - POSITION_T HPosOnes[N0][DV]) { - - for (int i = 0; i < N0; i++) { +void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], POSITION_T HPosOnes[N0][DV]) { + for (size_t i = 0; i < N0; i++) { /* Obtain directly the sparse representation of the block of H */ - for (int k = 0; k < DV; k++) { + for (size_t k = 0; k < DV; k++) { HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */ - }// end for k + } } } -void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], /* output*/ - POSITION_T QPosOnes[N0][M]) { +void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], POSITION_T QPosOnes[N0][M]) { + POSITION_T transposed_ones_idx[N0] = {0x00}; + size_t currQoneIdx, endQblockIdx; - unsigned transposed_ones_idx[N0] = {0x00}; - for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { - int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] - int endQblockIdx = 0; + for (size_t source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { + currQoneIdx = 0; // position in the column of QtrPosOnes[][...] + endQblockIdx = 0; for (int blockIdx = 0; blockIdx < N0; blockIdx++) { endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; for (; currQoneIdx < endQblockIdx; currQoneIdx++) { - QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P - - QPosOnes[source_row_idx][currQoneIdx]) % P; + QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = + (P - QPosOnes[source_row_idx][currQoneIdx]) % P; transposed_ones_idx[blockIdx]++; } } diff --git a/crypto_kem/ledakemlt12/leaktime/bf_decoding.c b/crypto_kem/ledakemlt12/leaktime/bf_decoding.c index f095b7e7..6d27d761 100644 --- a/crypto_kem/ledakemlt12/leaktime/bf_decoding.c +++ b/crypto_kem/ledakemlt12/leaktime/bf_decoding.c @@ -7,22 +7,26 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(DIGIT err[], const POSITION_T HtrPosOnes[N0][DV], const POSITION_T QtrPosOnes[N0][M], DIGIT privateSyndrome[], - uint8_t threshold) { + uint8_t secondIterThreshold) { + DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; uint8_t unsatParityChecks[N0 * P]; POSITION_T currQBlkPos[M], currQBitPos[M]; - DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; + POSITION_T syndromePosToFlip, tmp; + unsigned int correlation, corrt_syndrome_based; + size_t currQoneIdx, endQblockIdx, currblockoffset; int check; int iteration = 0; - unsigned int corrt_syndrome_based; do { PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); - for (int i = 0; i < N0; i++) { - for (int valueIdx = 0; valueIdx < P; valueIdx++) { - for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { - POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx); + for (size_t i = 0; i < N0; i++) { + for (size_t valueIdx = 0; valueIdx < P; valueIdx++) { + for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { + tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? + (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : + (HtrPosOnes[i][HtrOneIdx] + valueIdx); if (PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { unsatParityChecks[i * P + valueIdx]++; } @@ -31,33 +35,32 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(DIGIT err[], } /* iteration based threshold determination*/ - corrt_syndrome_based = iteration ? (unsigned int) threshold : B0; + corrt_syndrome_based = iteration * secondIterThreshold + (1 - iteration) * B0; - //Computation of correlation with a full Q matrix - for (int i = 0; i < N0; i++) { - for (int j = 0; j < P; j++) { - int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] - int endQblockIdx = 0; - unsigned int correlation = 0; + // Computation of correlation with a full Q matrix + for (size_t i = 0; i < N0; i++) { + for (size_t j = 0; j < P; j++) { + currQoneIdx = endQblockIdx = 0; + correlation = 0; - for (int blockIdx = 0; blockIdx < N0; blockIdx++) { + for (size_t blockIdx = 0; blockIdx < N0; blockIdx++) { endQblockIdx += qBlockWeights[blockIdx][i]; - int currblockoffset = blockIdx * P; + currblockoffset = blockIdx * P; for (; currQoneIdx < endQblockIdx; currQoneIdx++) { - POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j; + tmp = QtrPosOnes[i][currQoneIdx] + j; tmp = tmp >= P ? tmp - P : tmp; currQBitPos[currQoneIdx] = tmp; currQBlkPos[currQoneIdx] = blockIdx; correlation += unsatParityChecks[tmp + currblockoffset]; } } + /* Correlation based flipping */ if (correlation >= corrt_syndrome_based) { PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); - for (int v = 0; v < M; v++) { - POSITION_T syndromePosToFlip; - for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { - syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] ); + for (size_t v = 0; v < M; v++) { + for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { + syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v]); syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); } diff --git a/crypto_kem/ledakemlt12/leaktime/dfr_test.c b/crypto_kem/ledakemlt12/leaktime/dfr_test.c index ab5e2928..dea8b6f3 100644 --- a/crypto_kem/ledakemlt12/leaktime/dfr_test.c +++ b/crypto_kem/ledakemlt12/leaktime/dfr_test.c @@ -14,47 +14,49 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_ unsigned int maxMut[N0], maxMutMinusOne[N0]; unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; unsigned int gammaHist[N0][DV * M + 1] = {{0}}; + unsigned int toAdd; + size_t histIdx; - for (int i = 0; i < N0; i++) { - for (int j = 0; j < DV * M; j++) { + for (size_t i = 0; i < N0; i++) { + for (size_t j = 0; j < DV * M; j++) { if (LSparse[i][j] != 0) { - LSparse_loc[i][j] = (P - LSparse[i][j]) ; + LSparse_loc[i][j] = (P - LSparse[i][j]); } } PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M); } - for (int i = 0; i < N0; i++ ) { - for (int j = 0; j < N0; j++ ) { - for (int k = 0; k < (DV * M); k++) { - for (int l = 0; l < (DV * M); l++) { - gamma[i][j][ (P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P ]++; + for (size_t i = 0; i < N0; i++ ) { + for (size_t j = 0; j < N0; j++) { + for (size_t k = 0; k < (DV * M); k++) { + for (size_t l = 0; l < (DV * M); l++) { + gamma[i][j][(P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P]++; } } } } - for (int i = 0; i < N0; i++ ) { - for (int j = 0; j < N0; j++ ) { + for (size_t i = 0; i < N0; i++ ) { + for (size_t j = 0; j < N0; j++ ) { gamma[i][j][0] = 0; } } /* build histogram of values in gamma */ - for (int i = 0; i < N0; i++ ) { - for (int j = 0; j < N0; j++ ) { - for (int k = 0; k < P; k++) { + for (size_t i = 0; i < N0; i++ ) { + for (size_t j = 0; j < N0; j++ ) { + for (size_t k = 0; k < P; k++) { gammaHist[i][gamma[i][j][k]]++; } } } - for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { - unsigned int toAdd = T_BAR - 1; + for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { maxMutMinusOne[gammaBlockRowIdx] = 0; - unsigned int histIdx = DV * M; + histIdx = DV * M; + toAdd = T_BAR - 1; while ( (histIdx > 0) && (toAdd > 0)) { if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; @@ -71,7 +73,7 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_ /*seek max values across all gamma blocks */ allBlockMaxSumst = maxMut[0]; allBlockMaxSumstMinusOne = maxMutMinusOne[0]; - for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { + for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? maxMut[gammaBlockRowIdx] : allBlockMaxSumst; diff --git a/crypto_kem/ledakemlt12/leaktime/gf2x_arith.c b/crypto_kem/ledakemlt12/leaktime/gf2x_arith.c index bdf8f42c..086d4a2c 100644 --- a/crypto_kem/ledakemlt12/leaktime/gf2x_arith.c +++ b/crypto_kem/ledakemlt12/leaktime/gf2x_arith.c @@ -52,7 +52,7 @@ static void gf2x_mul1(DIGIT *R, const DIGIT A, const DIGIT B) { R[0] = 0; R[1] = (A & 1) * B; - for (unsigned i = 1; i < DIGIT_SIZE_b; i++) { + for (uint8_t i = 1; i < DIGIT_SIZE_b; i++) { tmp = ((A >> i) & 1) * B; R[1] ^= tmp << i; R[0] ^= tmp >> (DIGIT_SIZE_b - i); diff --git a/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.c b/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.c index cb01a001..0753efa2 100644 --- a/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.c +++ b/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.c @@ -5,39 +5,39 @@ #include // memcpy(...), memset(...) void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { - for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { + for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { dest[i] = in[i]; } } /* returns the coefficient of the x^exponent term as the LSB of a digit */ -DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) { - unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; - unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; - unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; +DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent) { + size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + size_t digitIdx = straightIdx / DIGIT_SIZE_b; + size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; } /* sets the coefficient of the x^exponent term as the LSB of a digit */ -void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) { - unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; - unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; - unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value) { + size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + size_t digitIdx = straightIdx / DIGIT_SIZE_b; + size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; /* clear given coefficient */ - DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + DIGIT mask = ~(((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); poly[digitIdx] = poly[digitIdx] & mask; - poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + poly[digitIdx] = poly[digitIdx] | ((value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); } /* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ -void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) { - unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; - unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; - unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent) { + size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + size_t digitIdx = straightIdx / DIGIT_SIZE_b; + size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; /* clear given coefficient */ - DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + DIGIT mask = (((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); poly[digitIdx] = poly[digitIdx] ^ mask; } @@ -51,7 +51,7 @@ static int popcount_uint64t(uint64_t x) { } /* population count for a single polynomial */ -int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(DIGIT *poly) { +int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(const DIGIT *poly) { int ret = 0; for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { ret += popcount_uint64t(poly[i]); @@ -74,10 +74,9 @@ static void gf2x_mod(DIGIT out[], const DIGIT in[]) { out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1; } -static void right_bit_shift(unsigned int length, DIGIT in[]) { - - unsigned int j; - for (j = length - 1; j > 0 ; j--) { +static void right_bit_shift(size_t length, DIGIT in[]) { + size_t j; + for (j = length - 1; j > 0; j--) { in[j] >>= 1; in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); } @@ -86,8 +85,8 @@ static void right_bit_shift(unsigned int length, DIGIT in[]) { /* shifts by whole digits */ -static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) { - unsigned int j; +static void left_DIGIT_shift_n(size_t length, DIGIT in[], size_t amount) { + size_t j; for (j = 0; (j + amount) < length; j++) { in[j] = in[j + amount]; } @@ -97,7 +96,7 @@ static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amo } /* may shift by an arbitrary amount*/ -static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) { +static void left_bit_shift_wide_n(size_t length, DIGIT in[], size_t amount) { left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); PQCLEAN_LEDAKEMLT12_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); } @@ -123,19 +122,21 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) { DIGIT mask = (DIGIT)0x1; DIGIT rev1, rev2, a00; - int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; + int slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); - for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { + for (size_t i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { rev1 = reverse_digit(A[i]); rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); A[i] = rev2; A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; } - A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]); + if (NUM_DIGITS_GF2X_ELEMENT % 2 == 1) { + A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]); + } if (slack_bits_amount) { PQCLEAN_LEDAKEMLT12_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); @@ -153,10 +154,9 @@ static void rotate_bit_right(DIGIT in[]) { /* x^{-1} * in(x) mod x^P+1 */ } /* cond swap: swaps digits A and B if swap_mask == -1 */ -static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { - int i; +static void gf2x_cswap(DIGIT *a, DIGIT *b, int32_t swap_mask) { DIGIT t; - for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { t = swap_mask & (a[i] ^ b[i]); a[i] ^= t; b[i] ^= t; @@ -164,18 +164,18 @@ static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { } /* returns -1 mask if x != 0, otherwise 0 */ -static inline int nonzero(DIGIT x) { +static inline int32_t nonzero(DIGIT x) { DIGIT t = x; t = (~t) + 1; t >>= DIGIT_SIZE_b - 1; - return -((int)t); + return -((int32_t)t); } /* returns -1 mask if x < 0 else 0 */ -static inline int negative(int x) { +static inline int32_t negative(int x) { uint32_t u = x; u >>= 31; - return -((int)u); + return -((int32_t)u); } /* return f(0) as digit */ @@ -193,7 +193,7 @@ static void gf2x_mult_scalar_acc(DIGIT *f, const DIGIT *g, const DIGIT s) { /* constant-time inverse, source: gcd.cr.yp.to */ int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { - int i, loop, swap, delta = 1; + int32_t swap, delta = 1; DIGIT g0_mask; DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1 @@ -204,17 +204,17 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) f[NUM_DIGITS_GF2X_MODULUS - 1] = 1; f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); - for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { g[i] = in[i]; } - for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { v[i] = 0; } r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1; - for (loop = 0; loop < 2 * P - 1; ++loop) { + for (int loop = 0; loop < 2 * P - 1; ++loop) { swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0 delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap @@ -249,7 +249,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], con /*PRE: the representation of the sparse coefficients is sorted in increasing order of the coefficients themselves */ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], - POSITION_T sparse[], unsigned int nPos) { + POSITION_T sparse[], size_t nPos) { DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; @@ -260,7 +260,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); - for (unsigned int i = 1; i < nPos; i++) { + for (size_t i = 1; i < nPos; i++) { if (sparse[i] != INVALID_POS_VALUE) { left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); @@ -272,10 +272,9 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons } -void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) { - +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]) { POSITION_T t; - int i = 0, j; + size_t i = 0, j; if (A[i] == 0) { i = 1; @@ -299,6 +298,9 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R size_t sizeB, const POSITION_T B[]) { POSITION_T prod; + POSITION_T lastReadPos; + size_t duplicateCount; + size_t write_idx, read_idx; /* compute all the coefficients, filling invalid positions with P*/ size_t lastFilledPos = 0; @@ -319,12 +321,11 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R Res[lastFilledPos] = INVALID_POS_VALUE; lastFilledPos++; } + PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(Res, sizeR); + /* eliminate duplicates */ - POSITION_T lastReadPos = Res[0]; - size_t duplicateCount; - size_t write_idx = 0; - size_t read_idx = 0; + write_idx = read_idx = 0; while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { lastReadPos = Res[read_idx]; read_idx++; @@ -346,13 +347,12 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R /* the implementation is safe even in case A or B alias with the result * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ -void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse( - int sizeR, POSITION_T Res[], - int sizeA, const POSITION_T A[], - int sizeB, const POSITION_T B[]) { +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], + size_t sizeA, const POSITION_T A[], + size_t sizeB, const POSITION_T B[]) { POSITION_T tmpRes[DV * M]; - int idxA = 0, idxB = 0, idxR = 0; + size_t idxA = 0, idxB = 0, idxR = 0; while ( idxA < sizeA && idxB < sizeB && A[idxA] != INVALID_POS_VALUE && @@ -421,18 +421,18 @@ static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct /* Obtains fresh randomness and seed-expands it until all the required positions * for the '1's in the circulant block are obtained */ void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, - int countOnes, + size_t countOnes, AES_XOF_struct *seed_expander_ctx) { - int duplicated, placedOnes = 0; - uint32_t p; + size_t duplicated, placedOnes = 0; + POSITION_T p; while (placedOnes < countOnes) { p = rand_range(NUM_BITS_GF2X_ELEMENT, P_BITS, seed_expander_ctx); duplicated = 0; - for (int j = 0; j < placedOnes; j++) { + for (size_t j = 0; j < placedOnes; j++) { if (pos_ones[j] == p) { duplicated = 1; } diff --git a/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.h b/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.h index c4c6d9ae..c01e136b 100644 --- a/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.h +++ b/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.h @@ -16,22 +16,22 @@ #define P_BITS (16) // log_2(p) = 15.6703 void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); -DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent); -void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value); -void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent); -int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(DIGIT *poly); +DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent); +int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(const DIGIT *poly); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); -void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, size_t countOnes, AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT12_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]); -void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]); -void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]); int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); -void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], size_t nPos); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); diff --git a/crypto_kem/ledakemlt12/leaktime/kem.c b/crypto_kem/ledakemlt12/leaktime/kem.c index e90a1e57..6144c190 100644 --- a/crypto_kem/ledakemlt12/leaktime/kem.c +++ b/crypto_kem/ledakemlt12/leaktime/kem.c @@ -107,18 +107,19 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH]; uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0}; uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0}; + int decode_ok, decrypt_ok, equal; unpack_ct(syndrome, ct); - int decode_ok = PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(decoded_error_vector, - (const privateKeyNiederreiter_t *)sk, syndrome); + decode_ok = PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(decoded_error_vector, + (const privateKeyNiederreiter_t *)sk, syndrome); pack_error(decoded_error_bytes, decoded_error_vector); HASH_FUNCTION(hashedErrorVector, decoded_error_bytes, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH); - for (int i = 0; i < TRNG_BYTE_LENGTH; ++i) { + for (size_t i = 0; i < TRNG_BYTE_LENGTH; ++i) { decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^ hashedAndTruncatedErrorVector[i]; } @@ -135,11 +136,11 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, PQCLEAN_LEDAKEMLT12_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos); - int equal = PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_verify(decoded_error_vector, - reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); + equal = PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_verify(decoded_error_vector, + reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); // equal == 0, if the reconstructed error vector match !!! - int decryptOk = (decode_ok == 1 && equal == 0); + decrypt_ok = (decode_ok == 1 && equal == 0); memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH); memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH); @@ -148,7 +149,7 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, PQCLEAN_LEDAKEMLT12_LEAKTIME_cmov(ss_input + sizeof(decoded_seed), ((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret, TRNG_BYTE_LENGTH, - !decryptOk); + !decrypt_ok); HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH); diff --git a/crypto_kem/ledakemlt12/leaktime/niederreiter.c b/crypto_kem/ledakemlt12/leaktime/niederreiter.c index 3004b39d..9d7cb7b5 100644 --- a/crypto_kem/ledakemlt12/leaktime/niederreiter.c +++ b/crypto_kem/ledakemlt12/leaktime/niederreiter.c @@ -49,7 +49,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p } } is_L_full = 1; - for (int i = 0; i < N0; i++) { + for (size_t i = 0; i < N0; i++) { is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); } sk->rejections = sk->rejections + 1; @@ -63,21 +63,21 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p sk->decryption_failure_secret, (unsigned long)TRNG_BYTE_LENGTH); - for (int j = 0; j < DV * M; j++) { + for (size_t j = 0; j < DV * M; j++) { if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); } } PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); - for (int i = 0; i < N0 - 1; i++) { + for (size_t i = 0; i < N0 - 1; i++) { PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, Ln0Inv, LPosOnes[i], DV * M); } - for (int i = 0; i < N0 - 1; i++) { + for (size_t i = 0; i < N0 - 1; i++) { PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); } } @@ -110,24 +110,27 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK POSITION_T auxSparse[DV * M]; POSITION_T Ln0trSparse[DV * M]; DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0}; + DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; - unsigned char processedQOnes[N0]; + uint8_t processedQOnes[N0]; int rejections = sk->rejections; + int decrypt_ok = 0; + int err_weight; PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); do { PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander); PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander); - for (int i = 0; i < N0; i++) { - for (int j = 0; j < DV * M; j++) { + for (size_t i = 0; i < N0; i++) { + for (size_t j = 0; j < DV * M; j++) { LPosOnes[i][j] = INVALID_POS_VALUE; } } memset(processedQOnes, 0x00, sizeof(processedQOnes)); - for (int colQ = 0; colQ < N0; colQ++) { - for (int i = 0; i < N0; i++) { + for (size_t colQ = 0; colQ < N0; colQ++) { + for (size_t i = 0; i < N0; i++) { PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, DV, HPosOnes[i], qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); @@ -143,15 +146,15 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes); PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes); - for (int i = 0; i < DV * M; i++) { + for (size_t i = 0; i < DV * M; i++) { Ln0trSparse[i] = INVALID_POS_VALUE; auxSparse[i] = INVALID_POS_VALUE; } - for (int i = 0; i < N0; i++) { + for (size_t i = 0; i < N0; i++) { PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, DV, HPosOnes[i], - qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1] ] ); + qBlockWeights[i][N0 - 1], &QPosOnes[i][M - qBlockWeights[i][N0 - 1]]); PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, DV * M, Ln0trSparse, DV * M, auxSparse); @@ -163,28 +166,27 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK Ln0trSparse, DV * M); - int decryptOk = 0; - decryptOk = PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(err_computed, - (const POSITION_T (*)[DV]) HtrPosOnes, - (const POSITION_T (*)[M]) QtrPosOnes, - privateSyndrome, sk->secondIterThreshold); + decrypt_ok = PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(err_computed, + (const POSITION_T (*)[DV]) HtrPosOnes, + (const POSITION_T (*)[M]) QtrPosOnes, + privateSyndrome, sk->secondIterThreshold); - int err_weight = 0; - for (int i = 0 ; i < N0; i++) { + err_weight = 0; + for (size_t i = 0 ; i < N0; i++) { err_weight += PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i)); } - decryptOk = decryptOk && (err_weight == NUM_ERRORS_T); + decrypt_ok = decrypt_ok && (err_weight == NUM_ERRORS_T); /* prepare mockup error vector in case a decoding failure occurs */ - DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH); memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00, (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH); memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); - // Overwrite on decryption failure - PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decryptOk); - return decryptOk; + // Overwrite on decryption failure + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decrypt_ok); + + return decrypt_ok; } diff --git a/crypto_kem/ledakemlt12/leaktime/rng.c b/crypto_kem/ledakemlt12/leaktime/rng.c index a827a4e0..f9d22b97 100644 --- a/crypto_kem/ledakemlt12/leaktime/rng.c +++ b/crypto_kem/ledakemlt12/leaktime/rng.c @@ -13,8 +13,8 @@ maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier */ static void seedexpander_init(AES_XOF_struct *ctx, - unsigned char *seed, - unsigned char *diversifier, + uint8_t *seed, + uint8_t *diversifier, size_t maxlen) { ctx->length_remaining = maxlen; @@ -38,13 +38,13 @@ static void seedexpander_init(AES_XOF_struct *ctx, } void PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, - const unsigned char *trng_entropy + const uint8_t *trng_entropy /* TRNG_BYTE_LENGTH wide buffer */) { /*the NIST seedexpander will however access 32B from this buffer */ unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; - unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 }; - unsigned char diversifier[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; + uint8_t prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = {0x00}; + uint8_t diversifier[8] = {0}; memcpy(prng_buffer, trng_entropy, @@ -61,7 +61,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, x - returns the XOF data xlen - number of bytes to return */ -int PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) { +int PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(AES_XOF_struct *ctx, uint8_t *x, size_t xlen) { size_t offset; aes256ctx ctx256; diff --git a/crypto_kem/ledakemlt12/leaktime/sort.c b/crypto_kem/ledakemlt12/leaktime/sort.c index d4fb98d0..6b89d7b5 100644 --- a/crypto_kem/ledakemlt12/leaktime/sort.c +++ b/crypto_kem/ledakemlt12/leaktime/sort.c @@ -5,6 +5,17 @@ Source: https://sorting.cr.yp.to */ +#define int32_MINMAX(a,b) \ + do { \ + int32 ab = (b) ^ (a); \ + int32 c = (b) - (a); \ + c ^= ab & (c ^ (b)); \ + c >>= 31; \ + c &= ab; \ + (a) ^= c; \ + (b) ^= c; \ + } while(0) + static void int32_sort(int32 *x, size_t n) { size_t top, p, q, r, i, j; diff --git a/crypto_kem/ledakemlt12/leaktime/sort.h b/crypto_kem/ledakemlt12/leaktime/sort.h index 300303c2..d870cc7c 100644 --- a/crypto_kem/ledakemlt12/leaktime/sort.h +++ b/crypto_kem/ledakemlt12/leaktime/sort.h @@ -6,17 +6,6 @@ #define int32 int32_t -#define int32_MINMAX(a,b) \ - do { \ - int32 ab = (b) ^ (a); \ - int32 c = (b) - (a); \ - c ^= ab & (c ^ (b)); \ - c >>= 31; \ - c &= ab; \ - (a) ^= c; \ - (b) ^= c; \ - } while(0) - void PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(uint32_t *x, size_t n); #endif diff --git a/crypto_kem/ledakemlt32/leaktime/H_Q_matrices_generation.c b/crypto_kem/ledakemlt32/leaktime/H_Q_matrices_generation.c index 92eeb549..305c3fc5 100644 --- a/crypto_kem/ledakemlt32/leaktime/H_Q_matrices_generation.c +++ b/crypto_kem/ledakemlt32/leaktime/H_Q_matrices_generation.c @@ -1,23 +1,19 @@ #include "H_Q_matrices_generation.h" #include "gf2x_arith_mod_xPplusOne.h" -void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], - AES_XOF_struct *keys_expander) { - - for (int i = 0; i < N0; i++) { +void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], AES_XOF_struct *keys_expander) { + for (size_t i = 0; i < N0; i++) { /* Generate a random block of Htr */ - PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], - DV, - keys_expander); + PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], DV, keys_expander); } } -void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], - AES_XOF_struct *keys_expander) { +void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], AES_XOF_struct *keys_expander) { + size_t placed_ones; - for (int i = 0; i < N0; i++) { - int placed_ones = 0; - for (int j = 0; j < N0; j++) { + for (size_t i = 0; i < N0; i++) { + placed_ones = 0; + for (size_t j = 0; j < N0; j++) { PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones], qBlockWeights[i][j], keys_expander); @@ -26,29 +22,27 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], } } -void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], /* output*/ - POSITION_T HPosOnes[N0][DV]) { - - for (int i = 0; i < N0; i++) { +void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], POSITION_T HPosOnes[N0][DV]) { + for (size_t i = 0; i < N0; i++) { /* Obtain directly the sparse representation of the block of H */ - for (int k = 0; k < DV; k++) { + for (size_t k = 0; k < DV; k++) { HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */ - }// end for k + } } } -void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], /* output*/ - POSITION_T QPosOnes[N0][M]) { +void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], POSITION_T QPosOnes[N0][M]) { + POSITION_T transposed_ones_idx[N0] = {0x00}; + size_t currQoneIdx, endQblockIdx; - unsigned transposed_ones_idx[N0] = {0x00}; - for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { - int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] - int endQblockIdx = 0; + for (size_t source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { + currQoneIdx = 0; // position in the column of QtrPosOnes[][...] + endQblockIdx = 0; for (int blockIdx = 0; blockIdx < N0; blockIdx++) { endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; for (; currQoneIdx < endQblockIdx; currQoneIdx++) { - QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P - - QPosOnes[source_row_idx][currQoneIdx]) % P; + QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = + (P - QPosOnes[source_row_idx][currQoneIdx]) % P; transposed_ones_idx[blockIdx]++; } } diff --git a/crypto_kem/ledakemlt32/leaktime/bf_decoding.c b/crypto_kem/ledakemlt32/leaktime/bf_decoding.c index 07957b6c..02f528e7 100644 --- a/crypto_kem/ledakemlt32/leaktime/bf_decoding.c +++ b/crypto_kem/ledakemlt32/leaktime/bf_decoding.c @@ -7,22 +7,26 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(DIGIT err[], const POSITION_T HtrPosOnes[N0][DV], const POSITION_T QtrPosOnes[N0][M], DIGIT privateSyndrome[], - uint8_t threshold) { + uint8_t secondIterThreshold) { + DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; uint8_t unsatParityChecks[N0 * P]; POSITION_T currQBlkPos[M], currQBitPos[M]; - DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; + POSITION_T syndromePosToFlip, tmp; + unsigned int correlation, corrt_syndrome_based; + size_t currQoneIdx, endQblockIdx, currblockoffset; int check; int iteration = 0; - unsigned int corrt_syndrome_based; do { PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); - for (int i = 0; i < N0; i++) { - for (int valueIdx = 0; valueIdx < P; valueIdx++) { - for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { - POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx); + for (size_t i = 0; i < N0; i++) { + for (size_t valueIdx = 0; valueIdx < P; valueIdx++) { + for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { + tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? + (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : + (HtrPosOnes[i][HtrOneIdx] + valueIdx); if (PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { unsatParityChecks[i * P + valueIdx]++; } @@ -31,33 +35,32 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(DIGIT err[], } /* iteration based threshold determination*/ - corrt_syndrome_based = iteration ? (unsigned int) threshold : B0; + corrt_syndrome_based = iteration * secondIterThreshold + (1 - iteration) * B0; - //Computation of correlation with a full Q matrix - for (int i = 0; i < N0; i++) { - for (int j = 0; j < P; j++) { - int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] - int endQblockIdx = 0; - unsigned int correlation = 0; + // Computation of correlation with a full Q matrix + for (size_t i = 0; i < N0; i++) { + for (size_t j = 0; j < P; j++) { + currQoneIdx = endQblockIdx = 0; + correlation = 0; - for (int blockIdx = 0; blockIdx < N0; blockIdx++) { + for (size_t blockIdx = 0; blockIdx < N0; blockIdx++) { endQblockIdx += qBlockWeights[blockIdx][i]; - int currblockoffset = blockIdx * P; + currblockoffset = blockIdx * P; for (; currQoneIdx < endQblockIdx; currQoneIdx++) { - POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j; + tmp = QtrPosOnes[i][currQoneIdx] + j; tmp = tmp >= P ? tmp - P : tmp; currQBitPos[currQoneIdx] = tmp; currQBlkPos[currQoneIdx] = blockIdx; correlation += unsatParityChecks[tmp + currblockoffset]; } } + /* Correlation based flipping */ if (correlation >= corrt_syndrome_based) { PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); - for (int v = 0; v < M; v++) { - POSITION_T syndromePosToFlip; - for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { - syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] ); + for (size_t v = 0; v < M; v++) { + for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { + syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v]); syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); } diff --git a/crypto_kem/ledakemlt32/leaktime/dfr_test.c b/crypto_kem/ledakemlt32/leaktime/dfr_test.c index 169a6b73..1235852d 100644 --- a/crypto_kem/ledakemlt32/leaktime/dfr_test.c +++ b/crypto_kem/ledakemlt32/leaktime/dfr_test.c @@ -14,47 +14,49 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_ unsigned int maxMut[N0], maxMutMinusOne[N0]; unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; unsigned int gammaHist[N0][DV * M + 1] = {{0}}; + unsigned int toAdd; + size_t histIdx; - for (int i = 0; i < N0; i++) { - for (int j = 0; j < DV * M; j++) { + for (size_t i = 0; i < N0; i++) { + for (size_t j = 0; j < DV * M; j++) { if (LSparse[i][j] != 0) { - LSparse_loc[i][j] = (P - LSparse[i][j]) ; + LSparse_loc[i][j] = (P - LSparse[i][j]); } } PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M); } - for (int i = 0; i < N0; i++ ) { - for (int j = 0; j < N0; j++ ) { - for (int k = 0; k < (DV * M); k++) { - for (int l = 0; l < (DV * M); l++) { - gamma[i][j][ (P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P ]++; + for (size_t i = 0; i < N0; i++ ) { + for (size_t j = 0; j < N0; j++) { + for (size_t k = 0; k < (DV * M); k++) { + for (size_t l = 0; l < (DV * M); l++) { + gamma[i][j][(P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P]++; } } } } - for (int i = 0; i < N0; i++ ) { - for (int j = 0; j < N0; j++ ) { + for (size_t i = 0; i < N0; i++ ) { + for (size_t j = 0; j < N0; j++ ) { gamma[i][j][0] = 0; } } /* build histogram of values in gamma */ - for (int i = 0; i < N0; i++ ) { - for (int j = 0; j < N0; j++ ) { - for (int k = 0; k < P; k++) { + for (size_t i = 0; i < N0; i++ ) { + for (size_t j = 0; j < N0; j++ ) { + for (size_t k = 0; k < P; k++) { gammaHist[i][gamma[i][j][k]]++; } } } - for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { - unsigned int toAdd = T_BAR - 1; + for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { maxMutMinusOne[gammaBlockRowIdx] = 0; - unsigned int histIdx = DV * M; + histIdx = DV * M; + toAdd = T_BAR - 1; while ( (histIdx > 0) && (toAdd > 0)) { if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; @@ -71,7 +73,7 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_ /*seek max values across all gamma blocks */ allBlockMaxSumst = maxMut[0]; allBlockMaxSumstMinusOne = maxMutMinusOne[0]; - for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { + for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? maxMut[gammaBlockRowIdx] : allBlockMaxSumst; diff --git a/crypto_kem/ledakemlt32/leaktime/gf2x_arith.c b/crypto_kem/ledakemlt32/leaktime/gf2x_arith.c index 1c961f81..9f2cedc9 100644 --- a/crypto_kem/ledakemlt32/leaktime/gf2x_arith.c +++ b/crypto_kem/ledakemlt32/leaktime/gf2x_arith.c @@ -52,7 +52,7 @@ static void gf2x_mul1(DIGIT *R, const DIGIT A, const DIGIT B) { R[0] = 0; R[1] = (A & 1) * B; - for (unsigned i = 1; i < DIGIT_SIZE_b; i++) { + for (uint8_t i = 1; i < DIGIT_SIZE_b; i++) { tmp = ((A >> i) & 1) * B; R[1] ^= tmp << i; R[0] ^= tmp >> (DIGIT_SIZE_b - i); diff --git a/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.c b/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.c index b459ea1b..bfe9c6b3 100644 --- a/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.c +++ b/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.c @@ -5,39 +5,39 @@ #include // memcpy(...), memset(...) void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { - for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { + for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { dest[i] = in[i]; } } /* returns the coefficient of the x^exponent term as the LSB of a digit */ -DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) { - unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; - unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; - unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; +DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent) { + size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + size_t digitIdx = straightIdx / DIGIT_SIZE_b; + size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; } /* sets the coefficient of the x^exponent term as the LSB of a digit */ -void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) { - unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; - unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; - unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value) { + size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + size_t digitIdx = straightIdx / DIGIT_SIZE_b; + size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; /* clear given coefficient */ - DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + DIGIT mask = ~(((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); poly[digitIdx] = poly[digitIdx] & mask; - poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + poly[digitIdx] = poly[digitIdx] | ((value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); } /* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ -void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) { - unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; - unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; - unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent) { + size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + size_t digitIdx = straightIdx / DIGIT_SIZE_b; + size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; /* clear given coefficient */ - DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + DIGIT mask = (((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); poly[digitIdx] = poly[digitIdx] ^ mask; } @@ -51,7 +51,7 @@ static int popcount_uint64t(uint64_t x) { } /* population count for a single polynomial */ -int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(DIGIT *poly) { +int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(const DIGIT *poly) { int ret = 0; for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { ret += popcount_uint64t(poly[i]); @@ -74,10 +74,9 @@ static void gf2x_mod(DIGIT out[], const DIGIT in[]) { out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1; } -static void right_bit_shift(unsigned int length, DIGIT in[]) { - - unsigned int j; - for (j = length - 1; j > 0 ; j--) { +static void right_bit_shift(size_t length, DIGIT in[]) { + size_t j; + for (j = length - 1; j > 0; j--) { in[j] >>= 1; in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); } @@ -86,8 +85,8 @@ static void right_bit_shift(unsigned int length, DIGIT in[]) { /* shifts by whole digits */ -static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) { - unsigned int j; +static void left_DIGIT_shift_n(size_t length, DIGIT in[], size_t amount) { + size_t j; for (j = 0; (j + amount) < length; j++) { in[j] = in[j + amount]; } @@ -97,7 +96,7 @@ static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amo } /* may shift by an arbitrary amount*/ -static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) { +static void left_bit_shift_wide_n(size_t length, DIGIT in[], size_t amount) { left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); PQCLEAN_LEDAKEMLT32_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); } @@ -123,18 +122,22 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) { DIGIT mask = (DIGIT)0x1; DIGIT rev1, rev2, a00; - int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; + int slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); - for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { + for (size_t i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { rev1 = reverse_digit(A[i]); rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); A[i] = rev2; A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; } + if (NUM_DIGITS_GF2X_ELEMENT % 2 == 1) { + A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]); + } + if (slack_bits_amount) { PQCLEAN_LEDAKEMLT32_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); } @@ -151,10 +154,9 @@ static void rotate_bit_right(DIGIT in[]) { /* x^{-1} * in(x) mod x^P+1 */ } /* cond swap: swaps digits A and B if swap_mask == -1 */ -static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { - int i; +static void gf2x_cswap(DIGIT *a, DIGIT *b, int32_t swap_mask) { DIGIT t; - for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { t = swap_mask & (a[i] ^ b[i]); a[i] ^= t; b[i] ^= t; @@ -162,18 +164,18 @@ static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { } /* returns -1 mask if x != 0, otherwise 0 */ -static inline int nonzero(DIGIT x) { +static inline int32_t nonzero(DIGIT x) { DIGIT t = x; t = (~t) + 1; t >>= DIGIT_SIZE_b - 1; - return -((int)t); + return -((int32_t)t); } /* returns -1 mask if x < 0 else 0 */ -static inline int negative(int x) { +static inline int32_t negative(int x) { uint32_t u = x; u >>= 31; - return -((int)u); + return -((int32_t)u); } /* return f(0) as digit */ @@ -191,7 +193,7 @@ static void gf2x_mult_scalar_acc(DIGIT *f, const DIGIT *g, const DIGIT s) { /* constant-time inverse, source: gcd.cr.yp.to */ int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { - int i, loop, swap, delta = 1; + int32_t swap, delta = 1; DIGIT g0_mask; DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1 @@ -202,17 +204,17 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) f[NUM_DIGITS_GF2X_MODULUS - 1] = 1; f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); - for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { g[i] = in[i]; } - for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { v[i] = 0; } r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1; - for (loop = 0; loop < 2 * P - 1; ++loop) { + for (int loop = 0; loop < 2 * P - 1; ++loop) { swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0 delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap @@ -247,7 +249,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], con /*PRE: the representation of the sparse coefficients is sorted in increasing order of the coefficients themselves */ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], - POSITION_T sparse[], unsigned int nPos) { + POSITION_T sparse[], size_t nPos) { DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; @@ -258,7 +260,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); - for (unsigned int i = 1; i < nPos; i++) { + for (size_t i = 1; i < nPos; i++) { if (sparse[i] != INVALID_POS_VALUE) { left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); @@ -270,10 +272,9 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons } -void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) { - +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]) { POSITION_T t; - int i = 0, j; + size_t i = 0, j; if (A[i] == 0) { i = 1; @@ -297,6 +298,9 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R size_t sizeB, const POSITION_T B[]) { POSITION_T prod; + POSITION_T lastReadPos; + size_t duplicateCount; + size_t write_idx, read_idx; /* compute all the coefficients, filling invalid positions with P*/ size_t lastFilledPos = 0; @@ -317,12 +321,11 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R Res[lastFilledPos] = INVALID_POS_VALUE; lastFilledPos++; } + PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(Res, sizeR); + /* eliminate duplicates */ - POSITION_T lastReadPos = Res[0]; - size_t duplicateCount; - size_t write_idx = 0; - size_t read_idx = 0; + write_idx = read_idx = 0; while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { lastReadPos = Res[read_idx]; read_idx++; @@ -344,13 +347,12 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R /* the implementation is safe even in case A or B alias with the result * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ -void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse( - int sizeR, POSITION_T Res[], - int sizeA, const POSITION_T A[], - int sizeB, const POSITION_T B[]) { +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], + size_t sizeA, const POSITION_T A[], + size_t sizeB, const POSITION_T B[]) { POSITION_T tmpRes[DV * M]; - int idxA = 0, idxB = 0, idxR = 0; + size_t idxA = 0, idxB = 0, idxR = 0; while ( idxA < sizeA && idxB < sizeB && A[idxA] != INVALID_POS_VALUE && @@ -419,18 +421,18 @@ static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct /* Obtains fresh randomness and seed-expands it until all the required positions * for the '1's in the circulant block are obtained */ void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, - int countOnes, + size_t countOnes, AES_XOF_struct *seed_expander_ctx) { - int duplicated, placedOnes = 0; - uint32_t p; + size_t duplicated, placedOnes = 0; + POSITION_T p; while (placedOnes < countOnes) { p = rand_range(NUM_BITS_GF2X_ELEMENT, P_BITS, seed_expander_ctx); duplicated = 0; - for (int j = 0; j < placedOnes; j++) { + for (size_t j = 0; j < placedOnes; j++) { if (pos_ones[j] == p) { duplicated = 1; } diff --git a/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.h b/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.h index 7ce000d7..9d554937 100644 --- a/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.h +++ b/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.h @@ -16,22 +16,22 @@ #define P_BITS (17) void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); -DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent); -void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value); -void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent); -int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(DIGIT *poly); +DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent); +int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(const DIGIT *poly); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); -void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, size_t countOnes, AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT32_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]); -void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]); -void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]); int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); -void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], size_t nPos); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); diff --git a/crypto_kem/ledakemlt32/leaktime/kem.c b/crypto_kem/ledakemlt32/leaktime/kem.c index 1a666cb9..c87b0d7f 100644 --- a/crypto_kem/ledakemlt32/leaktime/kem.c +++ b/crypto_kem/ledakemlt32/leaktime/kem.c @@ -107,18 +107,19 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH]; uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0}; uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0}; + int decode_ok, decrypt_ok, equal; unpack_ct(syndrome, ct); - int decode_ok = PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(decoded_error_vector, - (const privateKeyNiederreiter_t *)sk, syndrome); + decode_ok = PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(decoded_error_vector, + (const privateKeyNiederreiter_t *)sk, syndrome); pack_error(decoded_error_bytes, decoded_error_vector); HASH_FUNCTION(hashedErrorVector, decoded_error_bytes, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH); - for (int i = 0; i < TRNG_BYTE_LENGTH; ++i) { + for (size_t i = 0; i < TRNG_BYTE_LENGTH; ++i) { decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^ hashedAndTruncatedErrorVector[i]; } @@ -135,11 +136,11 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, PQCLEAN_LEDAKEMLT32_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos); - int equal = PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_verify(decoded_error_vector, - reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); + equal = PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_verify(decoded_error_vector, + reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); // equal == 0, if the reconstructed error vector match !!! - int decryptOk = (decode_ok == 1 && equal == 0); + decrypt_ok = (decode_ok == 1 && equal == 0); memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH); memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH); @@ -148,7 +149,7 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, PQCLEAN_LEDAKEMLT32_LEAKTIME_cmov(ss_input + sizeof(decoded_seed), ((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret, TRNG_BYTE_LENGTH, - !decryptOk); + !decrypt_ok); HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH); diff --git a/crypto_kem/ledakemlt32/leaktime/niederreiter.c b/crypto_kem/ledakemlt32/leaktime/niederreiter.c index 3c77436e..214ec030 100644 --- a/crypto_kem/ledakemlt32/leaktime/niederreiter.c +++ b/crypto_kem/ledakemlt32/leaktime/niederreiter.c @@ -49,7 +49,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p } } is_L_full = 1; - for (int i = 0; i < N0; i++) { + for (size_t i = 0; i < N0; i++) { is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); } sk->rejections = sk->rejections + 1; @@ -63,21 +63,21 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p sk->decryption_failure_secret, (unsigned long)TRNG_BYTE_LENGTH); - for (int j = 0; j < DV * M; j++) { + for (size_t j = 0; j < DV * M; j++) { if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); } } PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); - for (int i = 0; i < N0 - 1; i++) { + for (size_t i = 0; i < N0 - 1; i++) { PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, Ln0Inv, LPosOnes[i], DV * M); } - for (int i = 0; i < N0 - 1; i++) { + for (size_t i = 0; i < N0 - 1; i++) { PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); } } @@ -110,24 +110,27 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK POSITION_T auxSparse[DV * M]; POSITION_T Ln0trSparse[DV * M]; DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0}; + DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; - unsigned char processedQOnes[N0]; + uint8_t processedQOnes[N0]; int rejections = sk->rejections; + int decrypt_ok = 0; + int err_weight; PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); do { PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander); PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander); - for (int i = 0; i < N0; i++) { - for (int j = 0; j < DV * M; j++) { + for (size_t i = 0; i < N0; i++) { + for (size_t j = 0; j < DV * M; j++) { LPosOnes[i][j] = INVALID_POS_VALUE; } } memset(processedQOnes, 0x00, sizeof(processedQOnes)); - for (int colQ = 0; colQ < N0; colQ++) { - for (int i = 0; i < N0; i++) { + for (size_t colQ = 0; colQ < N0; colQ++) { + for (size_t i = 0; i < N0; i++) { PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, DV, HPosOnes[i], qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); @@ -143,15 +146,15 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes); PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes); - for (int i = 0; i < DV * M; i++) { + for (size_t i = 0; i < DV * M; i++) { Ln0trSparse[i] = INVALID_POS_VALUE; auxSparse[i] = INVALID_POS_VALUE; } - for (int i = 0; i < N0; i++) { + for (size_t i = 0; i < N0; i++) { PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, DV, HPosOnes[i], - qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1] ] ); + qBlockWeights[i][N0 - 1], &QPosOnes[i][M - qBlockWeights[i][N0 - 1]]); PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, DV * M, Ln0trSparse, DV * M, auxSparse); @@ -163,28 +166,27 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK Ln0trSparse, DV * M); - int decryptOk = 0; - decryptOk = PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(err_computed, - (const POSITION_T (*)[DV]) HtrPosOnes, - (const POSITION_T (*)[M]) QtrPosOnes, - privateSyndrome, sk->secondIterThreshold); + decrypt_ok = PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(err_computed, + (const POSITION_T (*)[DV]) HtrPosOnes, + (const POSITION_T (*)[M]) QtrPosOnes, + privateSyndrome, sk->secondIterThreshold); - int err_weight = 0; - for (int i = 0 ; i < N0; i++) { + err_weight = 0; + for (size_t i = 0 ; i < N0; i++) { err_weight += PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i)); } - decryptOk = decryptOk && (err_weight == NUM_ERRORS_T); + decrypt_ok = decrypt_ok && (err_weight == NUM_ERRORS_T); /* prepare mockup error vector in case a decoding failure occurs */ - DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH); memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00, (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH); memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); - // Overwrite on decryption failure - PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decryptOk); - return decryptOk; + // Overwrite on decryption failure + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decrypt_ok); + + return decrypt_ok; } diff --git a/crypto_kem/ledakemlt32/leaktime/rng.c b/crypto_kem/ledakemlt32/leaktime/rng.c index 23e2a63d..3c12deb4 100644 --- a/crypto_kem/ledakemlt32/leaktime/rng.c +++ b/crypto_kem/ledakemlt32/leaktime/rng.c @@ -13,8 +13,8 @@ maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier */ static void seedexpander_init(AES_XOF_struct *ctx, - unsigned char *seed, - unsigned char *diversifier, + uint8_t *seed, + uint8_t *diversifier, size_t maxlen) { ctx->length_remaining = maxlen; @@ -38,13 +38,13 @@ static void seedexpander_init(AES_XOF_struct *ctx, } void PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, - const unsigned char *trng_entropy + const uint8_t *trng_entropy /* TRNG_BYTE_LENGTH wide buffer */) { /*the NIST seedexpander will however access 32B from this buffer */ unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; - unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 }; - unsigned char diversifier[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; + uint8_t prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = {0x00}; + uint8_t diversifier[8] = {0}; memcpy(prng_buffer, trng_entropy, @@ -61,7 +61,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, x - returns the XOF data xlen - number of bytes to return */ -int PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) { +int PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(AES_XOF_struct *ctx, uint8_t *x, size_t xlen) { size_t offset; aes256ctx ctx256; diff --git a/crypto_kem/ledakemlt32/leaktime/sort.c b/crypto_kem/ledakemlt32/leaktime/sort.c index 2b6f8b8f..d3b4a158 100644 --- a/crypto_kem/ledakemlt32/leaktime/sort.c +++ b/crypto_kem/ledakemlt32/leaktime/sort.c @@ -5,6 +5,17 @@ Source: https://sorting.cr.yp.to */ +#define int32_MINMAX(a,b) \ + do { \ + int32 ab = (b) ^ (a); \ + int32 c = (b) - (a); \ + c ^= ab & (c ^ (b)); \ + c >>= 31; \ + c &= ab; \ + (a) ^= c; \ + (b) ^= c; \ + } while(0) + static void int32_sort(int32 *x, size_t n) { size_t top, p, q, r, i, j; diff --git a/crypto_kem/ledakemlt32/leaktime/sort.h b/crypto_kem/ledakemlt32/leaktime/sort.h index 40d83195..a17e2c49 100644 --- a/crypto_kem/ledakemlt32/leaktime/sort.h +++ b/crypto_kem/ledakemlt32/leaktime/sort.h @@ -6,17 +6,6 @@ #define int32 int32_t -#define int32_MINMAX(a,b) \ - do { \ - int32 ab = (b) ^ (a); \ - int32 c = (b) - (a); \ - c ^= ab & (c ^ (b)); \ - c >>= 31; \ - c &= ab; \ - (a) ^= c; \ - (b) ^= c; \ - } while(0) - void PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(uint32_t *x, size_t n); #endif diff --git a/crypto_kem/ledakemlt52/leaktime/H_Q_matrices_generation.c b/crypto_kem/ledakemlt52/leaktime/H_Q_matrices_generation.c index 29c87b6d..4706578b 100644 --- a/crypto_kem/ledakemlt52/leaktime/H_Q_matrices_generation.c +++ b/crypto_kem/ledakemlt52/leaktime/H_Q_matrices_generation.c @@ -1,23 +1,19 @@ #include "H_Q_matrices_generation.h" #include "gf2x_arith_mod_xPplusOne.h" -void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], - AES_XOF_struct *keys_expander) { - - for (int i = 0; i < N0; i++) { +void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], AES_XOF_struct *keys_expander) { + for (size_t i = 0; i < N0; i++) { /* Generate a random block of Htr */ - PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], - DV, - keys_expander); + PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], DV, keys_expander); } } -void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], - AES_XOF_struct *keys_expander) { +void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], AES_XOF_struct *keys_expander) { + size_t placed_ones; - for (int i = 0; i < N0; i++) { - int placed_ones = 0; - for (int j = 0; j < N0; j++) { + for (size_t i = 0; i < N0; i++) { + placed_ones = 0; + for (size_t j = 0; j < N0; j++) { PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones], qBlockWeights[i][j], keys_expander); @@ -26,29 +22,27 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], } } -void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], /* output*/ - POSITION_T HPosOnes[N0][DV]) { - - for (int i = 0; i < N0; i++) { +void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], POSITION_T HPosOnes[N0][DV]) { + for (size_t i = 0; i < N0; i++) { /* Obtain directly the sparse representation of the block of H */ - for (int k = 0; k < DV; k++) { + for (size_t k = 0; k < DV; k++) { HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */ - }// end for k + } } } -void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], /* output*/ - POSITION_T QPosOnes[N0][M]) { +void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], POSITION_T QPosOnes[N0][M]) { + POSITION_T transposed_ones_idx[N0] = {0x00}; + size_t currQoneIdx, endQblockIdx; - unsigned transposed_ones_idx[N0] = {0x00}; - for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { - int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] - int endQblockIdx = 0; + for (size_t source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { + currQoneIdx = 0; // position in the column of QtrPosOnes[][...] + endQblockIdx = 0; for (int blockIdx = 0; blockIdx < N0; blockIdx++) { endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; for (; currQoneIdx < endQblockIdx; currQoneIdx++) { - QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P - - QPosOnes[source_row_idx][currQoneIdx]) % P; + QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = + (P - QPosOnes[source_row_idx][currQoneIdx]) % P; transposed_ones_idx[blockIdx]++; } } diff --git a/crypto_kem/ledakemlt52/leaktime/bf_decoding.c b/crypto_kem/ledakemlt52/leaktime/bf_decoding.c index 4d35a3fd..7c76fb67 100644 --- a/crypto_kem/ledakemlt52/leaktime/bf_decoding.c +++ b/crypto_kem/ledakemlt52/leaktime/bf_decoding.c @@ -7,22 +7,26 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(DIGIT err[], const POSITION_T HtrPosOnes[N0][DV], const POSITION_T QtrPosOnes[N0][M], DIGIT privateSyndrome[], - uint8_t threshold) { + uint8_t secondIterThreshold) { + DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; uint8_t unsatParityChecks[N0 * P]; POSITION_T currQBlkPos[M], currQBitPos[M]; - DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; + POSITION_T syndromePosToFlip, tmp; + unsigned int correlation, corrt_syndrome_based; + size_t currQoneIdx, endQblockIdx, currblockoffset; int check; int iteration = 0; - unsigned int corrt_syndrome_based; do { PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); - for (int i = 0; i < N0; i++) { - for (int valueIdx = 0; valueIdx < P; valueIdx++) { - for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { - POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx); + for (size_t i = 0; i < N0; i++) { + for (size_t valueIdx = 0; valueIdx < P; valueIdx++) { + for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { + tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? + (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : + (HtrPosOnes[i][HtrOneIdx] + valueIdx); if (PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { unsatParityChecks[i * P + valueIdx]++; } @@ -31,33 +35,32 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(DIGIT err[], } /* iteration based threshold determination*/ - corrt_syndrome_based = iteration ? (unsigned int) threshold : B0; + corrt_syndrome_based = iteration * secondIterThreshold + (1 - iteration) * B0; - //Computation of correlation with a full Q matrix - for (int i = 0; i < N0; i++) { - for (int j = 0; j < P; j++) { - int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] - int endQblockIdx = 0; - unsigned int correlation = 0; + // Computation of correlation with a full Q matrix + for (size_t i = 0; i < N0; i++) { + for (size_t j = 0; j < P; j++) { + currQoneIdx = endQblockIdx = 0; + correlation = 0; - for (int blockIdx = 0; blockIdx < N0; blockIdx++) { + for (size_t blockIdx = 0; blockIdx < N0; blockIdx++) { endQblockIdx += qBlockWeights[blockIdx][i]; - int currblockoffset = blockIdx * P; + currblockoffset = blockIdx * P; for (; currQoneIdx < endQblockIdx; currQoneIdx++) { - POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j; + tmp = QtrPosOnes[i][currQoneIdx] + j; tmp = tmp >= P ? tmp - P : tmp; currQBitPos[currQoneIdx] = tmp; currQBlkPos[currQoneIdx] = blockIdx; correlation += unsatParityChecks[tmp + currblockoffset]; } } + /* Correlation based flipping */ if (correlation >= corrt_syndrome_based) { PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); - for (int v = 0; v < M; v++) { - POSITION_T syndromePosToFlip; - for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { - syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] ); + for (size_t v = 0; v < M; v++) { + for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { + syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v]); syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); } diff --git a/crypto_kem/ledakemlt52/leaktime/dfr_test.c b/crypto_kem/ledakemlt52/leaktime/dfr_test.c index 3199d403..31a4f93e 100644 --- a/crypto_kem/ledakemlt52/leaktime/dfr_test.c +++ b/crypto_kem/ledakemlt52/leaktime/dfr_test.c @@ -14,47 +14,49 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_ unsigned int maxMut[N0], maxMutMinusOne[N0]; unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; unsigned int gammaHist[N0][DV * M + 1] = {{0}}; + unsigned int toAdd; + size_t histIdx; - for (int i = 0; i < N0; i++) { - for (int j = 0; j < DV * M; j++) { + for (size_t i = 0; i < N0; i++) { + for (size_t j = 0; j < DV * M; j++) { if (LSparse[i][j] != 0) { - LSparse_loc[i][j] = (P - LSparse[i][j]) ; + LSparse_loc[i][j] = (P - LSparse[i][j]); } } PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M); } - for (int i = 0; i < N0; i++ ) { - for (int j = 0; j < N0; j++ ) { - for (int k = 0; k < (DV * M); k++) { - for (int l = 0; l < (DV * M); l++) { - gamma[i][j][ (P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P ]++; + for (size_t i = 0; i < N0; i++ ) { + for (size_t j = 0; j < N0; j++) { + for (size_t k = 0; k < (DV * M); k++) { + for (size_t l = 0; l < (DV * M); l++) { + gamma[i][j][(P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P]++; } } } } - for (int i = 0; i < N0; i++ ) { - for (int j = 0; j < N0; j++ ) { + for (size_t i = 0; i < N0; i++ ) { + for (size_t j = 0; j < N0; j++ ) { gamma[i][j][0] = 0; } } /* build histogram of values in gamma */ - for (int i = 0; i < N0; i++ ) { - for (int j = 0; j < N0; j++ ) { - for (int k = 0; k < P; k++) { + for (size_t i = 0; i < N0; i++ ) { + for (size_t j = 0; j < N0; j++ ) { + for (size_t k = 0; k < P; k++) { gammaHist[i][gamma[i][j][k]]++; } } } - for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { - unsigned int toAdd = T_BAR - 1; + for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { maxMutMinusOne[gammaBlockRowIdx] = 0; - unsigned int histIdx = DV * M; + histIdx = DV * M; + toAdd = T_BAR - 1; while ( (histIdx > 0) && (toAdd > 0)) { if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; @@ -71,7 +73,7 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_ /*seek max values across all gamma blocks */ allBlockMaxSumst = maxMut[0]; allBlockMaxSumstMinusOne = maxMutMinusOne[0]; - for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { + for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? maxMut[gammaBlockRowIdx] : allBlockMaxSumst; diff --git a/crypto_kem/ledakemlt52/leaktime/gf2x_arith.c b/crypto_kem/ledakemlt52/leaktime/gf2x_arith.c index 86465754..8daf4665 100644 --- a/crypto_kem/ledakemlt52/leaktime/gf2x_arith.c +++ b/crypto_kem/ledakemlt52/leaktime/gf2x_arith.c @@ -52,7 +52,7 @@ static void gf2x_mul1(DIGIT *R, const DIGIT A, const DIGIT B) { R[0] = 0; R[1] = (A & 1) * B; - for (unsigned i = 1; i < DIGIT_SIZE_b; i++) { + for (uint8_t i = 1; i < DIGIT_SIZE_b; i++) { tmp = ((A >> i) & 1) * B; R[1] ^= tmp << i; R[0] ^= tmp >> (DIGIT_SIZE_b - i); diff --git a/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.c b/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.c index 020880ae..56584fc8 100644 --- a/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.c +++ b/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.c @@ -5,39 +5,39 @@ #include // memcpy(...), memset(...) void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { - for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { + for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { dest[i] = in[i]; } } /* returns the coefficient of the x^exponent term as the LSB of a digit */ -DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) { - unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; - unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; - unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; +DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent) { + size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + size_t digitIdx = straightIdx / DIGIT_SIZE_b; + size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; } /* sets the coefficient of the x^exponent term as the LSB of a digit */ -void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) { - unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; - unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; - unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value) { + size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + size_t digitIdx = straightIdx / DIGIT_SIZE_b; + size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; /* clear given coefficient */ - DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + DIGIT mask = ~(((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); poly[digitIdx] = poly[digitIdx] & mask; - poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + poly[digitIdx] = poly[digitIdx] | ((value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); } /* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ -void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) { - unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; - unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; - unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent) { + size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + size_t digitIdx = straightIdx / DIGIT_SIZE_b; + size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; /* clear given coefficient */ - DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + DIGIT mask = (((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); poly[digitIdx] = poly[digitIdx] ^ mask; } @@ -51,7 +51,7 @@ static int popcount_uint64t(uint64_t x) { } /* population count for a single polynomial */ -int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(DIGIT *poly) { +int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(const DIGIT *poly) { int ret = 0; for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { ret += popcount_uint64t(poly[i]); @@ -74,10 +74,9 @@ static void gf2x_mod(DIGIT out[], const DIGIT in[]) { out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1; } -static void right_bit_shift(unsigned int length, DIGIT in[]) { - - unsigned int j; - for (j = length - 1; j > 0 ; j--) { +static void right_bit_shift(size_t length, DIGIT in[]) { + size_t j; + for (j = length - 1; j > 0; j--) { in[j] >>= 1; in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); } @@ -86,8 +85,8 @@ static void right_bit_shift(unsigned int length, DIGIT in[]) { /* shifts by whole digits */ -static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) { - unsigned int j; +static void left_DIGIT_shift_n(size_t length, DIGIT in[], size_t amount) { + size_t j; for (j = 0; (j + amount) < length; j++) { in[j] = in[j + amount]; } @@ -97,7 +96,7 @@ static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amo } /* may shift by an arbitrary amount*/ -static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) { +static void left_bit_shift_wide_n(size_t length, DIGIT in[], size_t amount) { left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); PQCLEAN_LEDAKEMLT52_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); } @@ -123,18 +122,22 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) { DIGIT mask = (DIGIT)0x1; DIGIT rev1, rev2, a00; - int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; + int slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); - for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { + for (size_t i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { rev1 = reverse_digit(A[i]); rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); A[i] = rev2; A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; } + if (NUM_DIGITS_GF2X_ELEMENT % 2 == 1) { + A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]); + } + if (slack_bits_amount) { PQCLEAN_LEDAKEMLT52_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); } @@ -151,10 +154,9 @@ static void rotate_bit_right(DIGIT in[]) { /* x^{-1} * in(x) mod x^P+1 */ } /* cond swap: swaps digits A and B if swap_mask == -1 */ -static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { - int i; +static void gf2x_cswap(DIGIT *a, DIGIT *b, int32_t swap_mask) { DIGIT t; - for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { t = swap_mask & (a[i] ^ b[i]); a[i] ^= t; b[i] ^= t; @@ -162,18 +164,18 @@ static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { } /* returns -1 mask if x != 0, otherwise 0 */ -static inline int nonzero(DIGIT x) { +static inline int32_t nonzero(DIGIT x) { DIGIT t = x; t = (~t) + 1; t >>= DIGIT_SIZE_b - 1; - return -((int)t); + return -((int32_t)t); } /* returns -1 mask if x < 0 else 0 */ -static inline int negative(int x) { +static inline int32_t negative(int x) { uint32_t u = x; u >>= 31; - return -((int)u); + return -((int32_t)u); } /* return f(0) as digit */ @@ -191,7 +193,7 @@ static void gf2x_mult_scalar_acc(DIGIT *f, const DIGIT *g, const DIGIT s) { /* constant-time inverse, source: gcd.cr.yp.to */ int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { - int i, loop, swap, delta = 1; + int32_t swap, delta = 1; DIGIT g0_mask; DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1 @@ -202,17 +204,17 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) f[NUM_DIGITS_GF2X_MODULUS - 1] = 1; f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); - for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { g[i] = in[i]; } - for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { v[i] = 0; } r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1; - for (loop = 0; loop < 2 * P - 1; ++loop) { + for (int loop = 0; loop < 2 * P - 1; ++loop) { swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0 delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap @@ -247,7 +249,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], con /*PRE: the representation of the sparse coefficients is sorted in increasing order of the coefficients themselves */ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], - POSITION_T sparse[], unsigned int nPos) { + POSITION_T sparse[], size_t nPos) { DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; @@ -258,7 +260,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); - for (unsigned int i = 1; i < nPos; i++) { + for (size_t i = 1; i < nPos; i++) { if (sparse[i] != INVALID_POS_VALUE) { left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); @@ -270,10 +272,9 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons } -void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) { - +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]) { POSITION_T t; - int i = 0, j; + size_t i = 0, j; if (A[i] == 0) { i = 1; @@ -297,6 +298,9 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R size_t sizeB, const POSITION_T B[]) { POSITION_T prod; + POSITION_T lastReadPos; + size_t duplicateCount; + size_t write_idx, read_idx; /* compute all the coefficients, filling invalid positions with P*/ size_t lastFilledPos = 0; @@ -317,12 +321,11 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R Res[lastFilledPos] = INVALID_POS_VALUE; lastFilledPos++; } + PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(Res, sizeR); + /* eliminate duplicates */ - POSITION_T lastReadPos = Res[0]; - size_t duplicateCount; - size_t write_idx = 0; - size_t read_idx = 0; + write_idx = read_idx = 0; while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { lastReadPos = Res[read_idx]; read_idx++; @@ -344,13 +347,12 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R /* the implementation is safe even in case A or B alias with the result * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ -void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse( - int sizeR, POSITION_T Res[], - int sizeA, const POSITION_T A[], - int sizeB, const POSITION_T B[]) { +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], + size_t sizeA, const POSITION_T A[], + size_t sizeB, const POSITION_T B[]) { POSITION_T tmpRes[DV * M]; - int idxA = 0, idxB = 0, idxR = 0; + size_t idxA = 0, idxB = 0, idxR = 0; while ( idxA < sizeA && idxB < sizeB && A[idxA] != INVALID_POS_VALUE && @@ -419,18 +421,18 @@ static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct /* Obtains fresh randomness and seed-expands it until all the required positions * for the '1's in the circulant block are obtained */ void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, - int countOnes, + size_t countOnes, AES_XOF_struct *seed_expander_ctx) { - int duplicated, placedOnes = 0; - uint32_t p; + size_t duplicated, placedOnes = 0; + POSITION_T p; while (placedOnes < countOnes) { p = rand_range(NUM_BITS_GF2X_ELEMENT, P_BITS, seed_expander_ctx); duplicated = 0; - for (int j = 0; j < placedOnes; j++) { + for (size_t j = 0; j < placedOnes; j++) { if (pos_ones[j] == p) { duplicated = 1; } diff --git a/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.h b/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.h index c9ba927a..06e310b2 100644 --- a/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.h +++ b/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.h @@ -16,22 +16,22 @@ #define P_BITS (18) void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); -DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent); -void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value); -void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent); -int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(DIGIT *poly); +DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent); +int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(const DIGIT *poly); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); -void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, size_t countOnes, AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT52_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]); -void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]); -void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]); int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); -void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], size_t nPos); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); diff --git a/crypto_kem/ledakemlt52/leaktime/kem.c b/crypto_kem/ledakemlt52/leaktime/kem.c index 7f2cab03..1dd5d975 100644 --- a/crypto_kem/ledakemlt52/leaktime/kem.c +++ b/crypto_kem/ledakemlt52/leaktime/kem.c @@ -107,18 +107,19 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH]; uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0}; uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0}; + int decode_ok, decrypt_ok, equal; unpack_ct(syndrome, ct); - int decode_ok = PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(decoded_error_vector, - (const privateKeyNiederreiter_t *)sk, syndrome); + decode_ok = PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(decoded_error_vector, + (const privateKeyNiederreiter_t *)sk, syndrome); pack_error(decoded_error_bytes, decoded_error_vector); HASH_FUNCTION(hashedErrorVector, decoded_error_bytes, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH); - for (int i = 0; i < TRNG_BYTE_LENGTH; ++i) { + for (size_t i = 0; i < TRNG_BYTE_LENGTH; ++i) { decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^ hashedAndTruncatedErrorVector[i]; } @@ -135,11 +136,11 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, PQCLEAN_LEDAKEMLT52_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos); - int equal = PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_verify(decoded_error_vector, - reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); + equal = PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_verify(decoded_error_vector, + reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); // equal == 0, if the reconstructed error vector match !!! - int decryptOk = (decode_ok == 1 && equal == 0); + decrypt_ok = (decode_ok == 1 && equal == 0); memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH); memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH); @@ -148,7 +149,7 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, PQCLEAN_LEDAKEMLT52_LEAKTIME_cmov(ss_input + sizeof(decoded_seed), ((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret, TRNG_BYTE_LENGTH, - !decryptOk); + !decrypt_ok); HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH); diff --git a/crypto_kem/ledakemlt52/leaktime/niederreiter.c b/crypto_kem/ledakemlt52/leaktime/niederreiter.c index 4d6ab84a..6e9c90ff 100644 --- a/crypto_kem/ledakemlt52/leaktime/niederreiter.c +++ b/crypto_kem/ledakemlt52/leaktime/niederreiter.c @@ -49,7 +49,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p } } is_L_full = 1; - for (int i = 0; i < N0; i++) { + for (size_t i = 0; i < N0; i++) { is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); } sk->rejections = sk->rejections + 1; @@ -63,21 +63,21 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p sk->decryption_failure_secret, (unsigned long)TRNG_BYTE_LENGTH); - for (int j = 0; j < DV * M; j++) { + for (size_t j = 0; j < DV * M; j++) { if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); } } PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); - for (int i = 0; i < N0 - 1; i++) { + for (size_t i = 0; i < N0 - 1; i++) { PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, Ln0Inv, LPosOnes[i], DV * M); } - for (int i = 0; i < N0 - 1; i++) { + for (size_t i = 0; i < N0 - 1; i++) { PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); } } @@ -110,24 +110,27 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK POSITION_T auxSparse[DV * M]; POSITION_T Ln0trSparse[DV * M]; DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0}; + DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; - unsigned char processedQOnes[N0]; + uint8_t processedQOnes[N0]; int rejections = sk->rejections; + int decrypt_ok = 0; + int err_weight; PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); do { PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander); PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander); - for (int i = 0; i < N0; i++) { - for (int j = 0; j < DV * M; j++) { + for (size_t i = 0; i < N0; i++) { + for (size_t j = 0; j < DV * M; j++) { LPosOnes[i][j] = INVALID_POS_VALUE; } } memset(processedQOnes, 0x00, sizeof(processedQOnes)); - for (int colQ = 0; colQ < N0; colQ++) { - for (int i = 0; i < N0; i++) { + for (size_t colQ = 0; colQ < N0; colQ++) { + for (size_t i = 0; i < N0; i++) { PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, DV, HPosOnes[i], qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); @@ -143,15 +146,15 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes); PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes); - for (int i = 0; i < DV * M; i++) { + for (size_t i = 0; i < DV * M; i++) { Ln0trSparse[i] = INVALID_POS_VALUE; auxSparse[i] = INVALID_POS_VALUE; } - for (int i = 0; i < N0; i++) { + for (size_t i = 0; i < N0; i++) { PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, DV, HPosOnes[i], - qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1] ] ); + qBlockWeights[i][N0 - 1], &QPosOnes[i][M - qBlockWeights[i][N0 - 1]]); PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, DV * M, Ln0trSparse, DV * M, auxSparse); @@ -163,28 +166,27 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK Ln0trSparse, DV * M); - int decryptOk = 0; - decryptOk = PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(err_computed, - (const POSITION_T (*)[DV]) HtrPosOnes, - (const POSITION_T (*)[M]) QtrPosOnes, - privateSyndrome, sk->secondIterThreshold); + decrypt_ok = PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(err_computed, + (const POSITION_T (*)[DV]) HtrPosOnes, + (const POSITION_T (*)[M]) QtrPosOnes, + privateSyndrome, sk->secondIterThreshold); - int err_weight = 0; - for (int i = 0 ; i < N0; i++) { + err_weight = 0; + for (size_t i = 0 ; i < N0; i++) { err_weight += PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i)); } - decryptOk = decryptOk && (err_weight == NUM_ERRORS_T); + decrypt_ok = decrypt_ok && (err_weight == NUM_ERRORS_T); /* prepare mockup error vector in case a decoding failure occurs */ - DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH); memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00, (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH); memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); - // Overwrite on decryption failure - PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decryptOk); - return decryptOk; + // Overwrite on decryption failure + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decrypt_ok); + + return decrypt_ok; } diff --git a/crypto_kem/ledakemlt52/leaktime/rng.c b/crypto_kem/ledakemlt52/leaktime/rng.c index c309c0fc..760bb2b4 100644 --- a/crypto_kem/ledakemlt52/leaktime/rng.c +++ b/crypto_kem/ledakemlt52/leaktime/rng.c @@ -13,8 +13,8 @@ maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier */ static void seedexpander_init(AES_XOF_struct *ctx, - unsigned char *seed, - unsigned char *diversifier, + uint8_t *seed, + uint8_t *diversifier, size_t maxlen) { ctx->length_remaining = maxlen; @@ -38,13 +38,13 @@ static void seedexpander_init(AES_XOF_struct *ctx, } void PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, - const unsigned char *trng_entropy + const uint8_t *trng_entropy /* TRNG_BYTE_LENGTH wide buffer */) { /*the NIST seedexpander will however access 32B from this buffer */ unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; - unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 }; - unsigned char *diversifier = ((unsigned char *)trng_entropy) + 32; + uint8_t prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = {0x00}; + uint8_t *diversifier = (uint8_t *)trng_entropy + 32; memcpy(prng_buffer, trng_entropy, @@ -61,7 +61,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, x - returns the XOF data xlen - number of bytes to return */ -int PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) { +int PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(AES_XOF_struct *ctx, uint8_t *x, size_t xlen) { size_t offset; aes256ctx ctx256; diff --git a/crypto_kem/ledakemlt52/leaktime/sort.c b/crypto_kem/ledakemlt52/leaktime/sort.c index b677700d..5db05711 100644 --- a/crypto_kem/ledakemlt52/leaktime/sort.c +++ b/crypto_kem/ledakemlt52/leaktime/sort.c @@ -5,6 +5,17 @@ Source: https://sorting.cr.yp.to */ +#define int32_MINMAX(a,b) \ + do { \ + int32 ab = (b) ^ (a); \ + int32 c = (b) - (a); \ + c ^= ab & (c ^ (b)); \ + c >>= 31; \ + c &= ab; \ + (a) ^= c; \ + (b) ^= c; \ + } while(0) + static void int32_sort(int32 *x, size_t n) { size_t top, p, q, r, i, j; diff --git a/crypto_kem/ledakemlt52/leaktime/sort.h b/crypto_kem/ledakemlt52/leaktime/sort.h index db8c257f..e4f414c9 100644 --- a/crypto_kem/ledakemlt52/leaktime/sort.h +++ b/crypto_kem/ledakemlt52/leaktime/sort.h @@ -6,17 +6,6 @@ #define int32 int32_t -#define int32_MINMAX(a,b) \ - do { \ - int32 ab = (b) ^ (a); \ - int32 c = (b) - (a); \ - c ^= ab & (c ^ (b)); \ - c >>= 31; \ - c &= ab; \ - (a) ^= c; \ - (b) ^= c; \ - } while(0) - void PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(uint32_t *x, size_t n); #endif diff --git a/test/duplicate_consistency/ledakemlt12_leaktime.yml b/test/duplicate_consistency/ledakemlt12_leaktime.yml index cec7dd6e..ffd1f1fc 100644 --- a/test/duplicate_consistency/ledakemlt12_leaktime.yml +++ b/test/duplicate_consistency/ledakemlt12_leaktime.yml @@ -7,6 +7,7 @@ consistency_checks: - dfr_test.c - dfr_test.h - gf2x_arith.c + - gf2x_arith_mod_xPplusOne.c - H_Q_matrices_generation.c - H_Q_matrices_generation.h - kem.c @@ -24,6 +25,7 @@ consistency_checks: - dfr_test.c - dfr_test.h - gf2x_arith.c + - gf2x_arith_mod_xPplusOne.c - H_Q_matrices_generation.c - H_Q_matrices_generation.h - kem.c @@ -32,4 +34,3 @@ consistency_checks: - rng.h - utils.c - utils.h - diff --git a/test/duplicate_consistency/ledakemlt32_leaktime.yml b/test/duplicate_consistency/ledakemlt32_leaktime.yml index e0d3c872..e3781ebf 100644 --- a/test/duplicate_consistency/ledakemlt32_leaktime.yml +++ b/test/duplicate_consistency/ledakemlt32_leaktime.yml @@ -7,6 +7,7 @@ consistency_checks: - dfr_test.c - dfr_test.h - gf2x_arith.c + - gf2x_arith_mod_xPplusOne.c - H_Q_matrices_generation.c - H_Q_matrices_generation.h - kem.c @@ -24,6 +25,7 @@ consistency_checks: - dfr_test.c - dfr_test.h - gf2x_arith.c + - gf2x_arith_mod_xPplusOne.c - H_Q_matrices_generation.c - H_Q_matrices_generation.h - kem.c @@ -32,4 +34,3 @@ consistency_checks: - rng.h - utils.c - utils.h - diff --git a/test/duplicate_consistency/ledakemlt52_leaktime.yml b/test/duplicate_consistency/ledakemlt52_leaktime.yml index c1dce1cc..16c38911 100644 --- a/test/duplicate_consistency/ledakemlt52_leaktime.yml +++ b/test/duplicate_consistency/ledakemlt52_leaktime.yml @@ -7,6 +7,7 @@ consistency_checks: - dfr_test.c - dfr_test.h - gf2x_arith.c + - gf2x_arith_mod_xPplusOne.c - H_Q_matrices_generation.c - H_Q_matrices_generation.h - kem.c @@ -32,4 +33,3 @@ consistency_checks: - rng.h - utils.c - utils.h -