From 82383c204ee34e3197facb0f683a43dde9328d61 Mon Sep 17 00:00:00 2001
From: Douglas Stebila <dstebila@uwaterloo.ca>
Date: Thu, 20 Jun 2019 21:07:03 -0400
Subject: [PATCH 1/5] Add release function for AES key schedule

---
 common/aes.c                                  | 18 ++++++++++++++++++
 common/aes.h                                  |  6 ++++++
 crypto_kem/frodokem1344aes/clean/matrix_aes.c |  2 ++
 crypto_kem/frodokem1344aes/opt/matrix_aes.c   |  2 ++
 crypto_kem/frodokem640aes/clean/matrix_aes.c  |  2 ++
 crypto_kem/frodokem640aes/opt/matrix_aes.c    |  2 ++
 crypto_kem/frodokem976aes/clean/matrix_aes.c  |  2 ++
 crypto_kem/frodokem976aes/opt/matrix_aes.c    |  2 ++
 crypto_kem/ledakemlt12/leaktime/rng.c         |  1 +
 crypto_kem/ledakemlt32/leaktime/rng.c         |  1 +
 crypto_kem/ledakemlt52/leaktime/rng.c         |  1 +
 test/common/aes.c                             |  4 ++++
 12 files changed, 43 insertions(+)

diff --git a/common/aes.c b/common/aes.c
index 9533c117..a46efcb7 100644
--- a/common/aes.c
+++ b/common/aes.c
@@ -622,3 +622,21 @@ void aes256_ctr(unsigned char *out, size_t outlen, const unsigned char *iv, cons
     aes_ctr(out, outlen, iv, ctx->sk_exp, 14);
 }
 
+#ifdef __GNUC__
+#  define UNUSED(x) UNUSED_ ## x __attribute__((__unused__))
+#else
+#  define UNUSED(x) UNUSED_ ## x
+#endif
+
+void aes128_ctx_release(aes128ctx *UNUSED(r)) {
+    // no-op for PQClean's basic AES operation
+}
+
+void aes192_ctx_release(aes192ctx *UNUSED(r)) {
+    // no-op for PQClean's basic AES operation
+}
+
+void aes256_ctx_release(aes256ctx *UNUSED(r)) {
+    // no-op for PQClean's basic AES operation
+}
+
diff --git a/common/aes.h b/common/aes.h
index ef1eca28..22da4b08 100644
--- a/common/aes.h
+++ b/common/aes.h
@@ -30,6 +30,8 @@ void aes128_ecb(unsigned char *out, const unsigned char *in, size_t nblocks, con
 
 void aes128_ctr(unsigned char *out, size_t outlen, const unsigned char *iv, const aes128ctx *ctx);
 
+void aes128_ctx_release(aes128ctx *r);
+
 
 void aes192_keyexp(aes192ctx *r, const unsigned char *key);
 
@@ -37,6 +39,8 @@ void aes192_ecb(unsigned char *out, const unsigned char *in, size_t nblocks, con
 
 void aes192_ctr(unsigned char *out, size_t outlen, const unsigned char *iv, const aes192ctx *ctx);
 
+void aes192_ctx_release(aes192ctx *r);
+
 
 void aes256_keyexp(aes256ctx *r, const unsigned char *key);
 
@@ -44,5 +48,7 @@ void aes256_ecb(unsigned char *out, const unsigned char *in, size_t nblocks, con
 
 void aes256_ctr(unsigned char *out, size_t outlen, const unsigned char *iv, const aes256ctx *ctx);
 
+void aes256_ctx_release(aes256ctx *r);
+
 
 #endif
diff --git a/crypto_kem/frodokem1344aes/clean/matrix_aes.c b/crypto_kem/frodokem1344aes/clean/matrix_aes.c
index 645901b0..7b9a830a 100644
--- a/crypto_kem/frodokem1344aes/clean/matrix_aes.c
+++ b/crypto_kem/frodokem1344aes/clean/matrix_aes.c
@@ -33,6 +33,7 @@ int PQCLEAN_FRODOKEM1344AES_CLEAN_mul_add_as_plus_e(uint16_t *out, const uint16_
     }
 
     aes128_ecb((uint8_t *) A, (uint8_t *) A, PARAMS_N * PARAMS_N * sizeof(int16_t) / AES_BLOCKBYTES, &ctx128);
+    aes128_ctx_release(&ctx128);
 
     for (i = 0; i < PARAMS_N * PARAMS_N; i++) {
         A[i] = PQCLEAN_FRODOKEM1344AES_CLEAN_LE_TO_UINT16(A[i]);
@@ -73,6 +74,7 @@ int PQCLEAN_FRODOKEM1344AES_CLEAN_mul_add_sa_plus_e(uint16_t *out, const uint16_
     }
 
     aes128_ecb((uint8_t *) A, (uint8_t *) A, PARAMS_N * PARAMS_N * sizeof(int16_t) / AES_BLOCKBYTES, &ctx128);
+    aes128_ctx_release(&ctx128);
 
     for (i = 0; i < PARAMS_N * PARAMS_N; i++) {
         A[i] = PQCLEAN_FRODOKEM1344AES_CLEAN_LE_TO_UINT16(A[i]);
diff --git a/crypto_kem/frodokem1344aes/opt/matrix_aes.c b/crypto_kem/frodokem1344aes/opt/matrix_aes.c
index 9d29da6c..51ff8c47 100644
--- a/crypto_kem/frodokem1344aes/opt/matrix_aes.c
+++ b/crypto_kem/frodokem1344aes/opt/matrix_aes.c
@@ -63,6 +63,7 @@ int PQCLEAN_FRODOKEM1344AES_OPT_mul_add_as_plus_e(uint16_t *out, const uint16_t
             out[(i + 3)*PARAMS_NBAR + k] += sum[3];
         }
     }
+    aes128_ctx_release(&ctx128);
     return 1;
 }
 
@@ -121,5 +122,6 @@ int PQCLEAN_FRODOKEM1344AES_OPT_mul_add_sa_plus_e(uint16_t *out, const uint16_t
             }
         }
     }
+    aes128_ctx_release(&ctx128);
     return 1;
 }
diff --git a/crypto_kem/frodokem640aes/clean/matrix_aes.c b/crypto_kem/frodokem640aes/clean/matrix_aes.c
index 65344e3d..1858b754 100644
--- a/crypto_kem/frodokem640aes/clean/matrix_aes.c
+++ b/crypto_kem/frodokem640aes/clean/matrix_aes.c
@@ -33,6 +33,7 @@ int PQCLEAN_FRODOKEM640AES_CLEAN_mul_add_as_plus_e(uint16_t *out, const uint16_t
     }
 
     aes128_ecb((uint8_t *) A, (uint8_t *) A, PARAMS_N * PARAMS_N * sizeof(int16_t) / AES_BLOCKBYTES, &ctx128);
+    aes128_ctx_release(&ctx128);
 
     for (i = 0; i < PARAMS_N * PARAMS_N; i++) {
         A[i] = PQCLEAN_FRODOKEM640AES_CLEAN_LE_TO_UINT16(A[i]);
@@ -73,6 +74,7 @@ int PQCLEAN_FRODOKEM640AES_CLEAN_mul_add_sa_plus_e(uint16_t *out, const uint16_t
     }
 
     aes128_ecb((uint8_t *) A, (uint8_t *) A, PARAMS_N * PARAMS_N * sizeof(int16_t) / AES_BLOCKBYTES, &ctx128);
+    aes128_ctx_release(&ctx128);
 
     for (i = 0; i < PARAMS_N * PARAMS_N; i++) {
         A[i] = PQCLEAN_FRODOKEM640AES_CLEAN_LE_TO_UINT16(A[i]);
diff --git a/crypto_kem/frodokem640aes/opt/matrix_aes.c b/crypto_kem/frodokem640aes/opt/matrix_aes.c
index 24372876..2c03ead3 100644
--- a/crypto_kem/frodokem640aes/opt/matrix_aes.c
+++ b/crypto_kem/frodokem640aes/opt/matrix_aes.c
@@ -63,6 +63,7 @@ int PQCLEAN_FRODOKEM640AES_OPT_mul_add_as_plus_e(uint16_t *out, const uint16_t *
             out[(i + 3)*PARAMS_NBAR + k] += sum[3];
         }
     }
+    aes128_ctx_release(&ctx128);
     return 1;
 }
 
@@ -121,5 +122,6 @@ int PQCLEAN_FRODOKEM640AES_OPT_mul_add_sa_plus_e(uint16_t *out, const uint16_t *
             }
         }
     }
+    aes128_ctx_release(&ctx128);
     return 1;
 }
diff --git a/crypto_kem/frodokem976aes/clean/matrix_aes.c b/crypto_kem/frodokem976aes/clean/matrix_aes.c
index 2596fc25..f02ffb70 100644
--- a/crypto_kem/frodokem976aes/clean/matrix_aes.c
+++ b/crypto_kem/frodokem976aes/clean/matrix_aes.c
@@ -33,6 +33,7 @@ int PQCLEAN_FRODOKEM976AES_CLEAN_mul_add_as_plus_e(uint16_t *out, const uint16_t
     }
 
     aes128_ecb((uint8_t *) A, (uint8_t *) A, PARAMS_N * PARAMS_N * sizeof(int16_t) / AES_BLOCKBYTES, &ctx128);
+    aes128_ctx_release(&ctx128);
 
     for (i = 0; i < PARAMS_N * PARAMS_N; i++) {
         A[i] = PQCLEAN_FRODOKEM976AES_CLEAN_LE_TO_UINT16(A[i]);
@@ -73,6 +74,7 @@ int PQCLEAN_FRODOKEM976AES_CLEAN_mul_add_sa_plus_e(uint16_t *out, const uint16_t
     }
 
     aes128_ecb((uint8_t *) A, (uint8_t *) A, PARAMS_N * PARAMS_N * sizeof(int16_t) / AES_BLOCKBYTES, &ctx128);
+    aes128_ctx_release(&ctx128);
 
     for (i = 0; i < PARAMS_N * PARAMS_N; i++) {
         A[i] = PQCLEAN_FRODOKEM976AES_CLEAN_LE_TO_UINT16(A[i]);
diff --git a/crypto_kem/frodokem976aes/opt/matrix_aes.c b/crypto_kem/frodokem976aes/opt/matrix_aes.c
index a1332fc1..d703af93 100644
--- a/crypto_kem/frodokem976aes/opt/matrix_aes.c
+++ b/crypto_kem/frodokem976aes/opt/matrix_aes.c
@@ -63,6 +63,7 @@ int PQCLEAN_FRODOKEM976AES_OPT_mul_add_as_plus_e(uint16_t *out, const uint16_t *
             out[(i + 3)*PARAMS_NBAR + k] += sum[3];
         }
     }
+    aes128_ctx_release(&ctx128);
     return 1;
 }
 
@@ -121,5 +122,6 @@ int PQCLEAN_FRODOKEM976AES_OPT_mul_add_sa_plus_e(uint16_t *out, const uint16_t *
             }
         }
     }
+    aes128_ctx_release(&ctx128);
     return 1;
 }
diff --git a/crypto_kem/ledakemlt12/leaktime/rng.c b/crypto_kem/ledakemlt12/leaktime/rng.c
index 6d7604e6..a827a4e0 100644
--- a/crypto_kem/ledakemlt12/leaktime/rng.c
+++ b/crypto_kem/ledakemlt12/leaktime/rng.c
@@ -103,6 +103,7 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char
         }
 
     }
+    aes256_ctx_release(&ctx256);
 
     return RNG_SUCCESS;
 }
diff --git a/crypto_kem/ledakemlt32/leaktime/rng.c b/crypto_kem/ledakemlt32/leaktime/rng.c
index 4e18fa57..23e2a63d 100644
--- a/crypto_kem/ledakemlt32/leaktime/rng.c
+++ b/crypto_kem/ledakemlt32/leaktime/rng.c
@@ -103,6 +103,7 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char
         }
 
     }
+    aes256_ctx_release(&ctx256);
 
     return RNG_SUCCESS;
 }
diff --git a/crypto_kem/ledakemlt52/leaktime/rng.c b/crypto_kem/ledakemlt52/leaktime/rng.c
index b9f6c255..c309c0fc 100644
--- a/crypto_kem/ledakemlt52/leaktime/rng.c
+++ b/crypto_kem/ledakemlt52/leaktime/rng.c
@@ -103,6 +103,7 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char
         }
 
     }
+    aes256_ctx_release(&ctx256);
 
     return RNG_SUCCESS;
 }
diff --git a/test/common/aes.c b/test/common/aes.c
index d7759168..9209a42a 100644
--- a/test/common/aes.c
+++ b/test/common/aes.c
@@ -96,5 +96,9 @@ int main(void)
     r = 1;
   }
 
+  aes128_ctx_release(&ctx128);
+  aes192_ctx_release(&ctx192);
+  aes256_ctx_release(&ctx256);
+
   return r;
 }

From 4157e0fbad50d3ab1e49323f00ccb66a31485ce0 Mon Sep 17 00:00:00 2001
From: Douglas Stebila <dstebila@uwaterloo.ca>
Date: Thu, 20 Jun 2019 21:07:03 -0400
Subject: [PATCH 2/5] Add release function for AES key schedule

---
 common/aes.c                                  | 18 ++++++++++++++++++
 common/aes.h                                  |  6 ++++++
 crypto_kem/frodokem1344aes/clean/matrix_aes.c |  2 ++
 crypto_kem/frodokem1344aes/opt/matrix_aes.c   |  2 ++
 crypto_kem/frodokem640aes/clean/matrix_aes.c  |  2 ++
 crypto_kem/frodokem640aes/opt/matrix_aes.c    |  2 ++
 crypto_kem/frodokem976aes/clean/matrix_aes.c  |  2 ++
 crypto_kem/frodokem976aes/opt/matrix_aes.c    |  2 ++
 crypto_kem/ledakemlt12/leaktime/rng.c         |  1 +
 crypto_kem/ledakemlt32/leaktime/rng.c         |  1 +
 crypto_kem/ledakemlt52/leaktime/rng.c         |  1 +
 test/common/aes.c                             |  4 ++++
 12 files changed, 43 insertions(+)

diff --git a/common/aes.c b/common/aes.c
index 9533c117..a46efcb7 100644
--- a/common/aes.c
+++ b/common/aes.c
@@ -622,3 +622,21 @@ void aes256_ctr(unsigned char *out, size_t outlen, const unsigned char *iv, cons
     aes_ctr(out, outlen, iv, ctx->sk_exp, 14);
 }
 
+#ifdef __GNUC__
+#  define UNUSED(x) UNUSED_ ## x __attribute__((__unused__))
+#else
+#  define UNUSED(x) UNUSED_ ## x
+#endif
+
+void aes128_ctx_release(aes128ctx *UNUSED(r)) {
+    // no-op for PQClean's basic AES operation
+}
+
+void aes192_ctx_release(aes192ctx *UNUSED(r)) {
+    // no-op for PQClean's basic AES operation
+}
+
+void aes256_ctx_release(aes256ctx *UNUSED(r)) {
+    // no-op for PQClean's basic AES operation
+}
+
diff --git a/common/aes.h b/common/aes.h
index ef1eca28..22da4b08 100644
--- a/common/aes.h
+++ b/common/aes.h
@@ -30,6 +30,8 @@ void aes128_ecb(unsigned char *out, const unsigned char *in, size_t nblocks, con
 
 void aes128_ctr(unsigned char *out, size_t outlen, const unsigned char *iv, const aes128ctx *ctx);
 
+void aes128_ctx_release(aes128ctx *r);
+
 
 void aes192_keyexp(aes192ctx *r, const unsigned char *key);
 
@@ -37,6 +39,8 @@ void aes192_ecb(unsigned char *out, const unsigned char *in, size_t nblocks, con
 
 void aes192_ctr(unsigned char *out, size_t outlen, const unsigned char *iv, const aes192ctx *ctx);
 
+void aes192_ctx_release(aes192ctx *r);
+
 
 void aes256_keyexp(aes256ctx *r, const unsigned char *key);
 
@@ -44,5 +48,7 @@ void aes256_ecb(unsigned char *out, const unsigned char *in, size_t nblocks, con
 
 void aes256_ctr(unsigned char *out, size_t outlen, const unsigned char *iv, const aes256ctx *ctx);
 
+void aes256_ctx_release(aes256ctx *r);
+
 
 #endif
diff --git a/crypto_kem/frodokem1344aes/clean/matrix_aes.c b/crypto_kem/frodokem1344aes/clean/matrix_aes.c
index 645901b0..7b9a830a 100644
--- a/crypto_kem/frodokem1344aes/clean/matrix_aes.c
+++ b/crypto_kem/frodokem1344aes/clean/matrix_aes.c
@@ -33,6 +33,7 @@ int PQCLEAN_FRODOKEM1344AES_CLEAN_mul_add_as_plus_e(uint16_t *out, const uint16_
     }
 
     aes128_ecb((uint8_t *) A, (uint8_t *) A, PARAMS_N * PARAMS_N * sizeof(int16_t) / AES_BLOCKBYTES, &ctx128);
+    aes128_ctx_release(&ctx128);
 
     for (i = 0; i < PARAMS_N * PARAMS_N; i++) {
         A[i] = PQCLEAN_FRODOKEM1344AES_CLEAN_LE_TO_UINT16(A[i]);
@@ -73,6 +74,7 @@ int PQCLEAN_FRODOKEM1344AES_CLEAN_mul_add_sa_plus_e(uint16_t *out, const uint16_
     }
 
     aes128_ecb((uint8_t *) A, (uint8_t *) A, PARAMS_N * PARAMS_N * sizeof(int16_t) / AES_BLOCKBYTES, &ctx128);
+    aes128_ctx_release(&ctx128);
 
     for (i = 0; i < PARAMS_N * PARAMS_N; i++) {
         A[i] = PQCLEAN_FRODOKEM1344AES_CLEAN_LE_TO_UINT16(A[i]);
diff --git a/crypto_kem/frodokem1344aes/opt/matrix_aes.c b/crypto_kem/frodokem1344aes/opt/matrix_aes.c
index 9d29da6c..51ff8c47 100644
--- a/crypto_kem/frodokem1344aes/opt/matrix_aes.c
+++ b/crypto_kem/frodokem1344aes/opt/matrix_aes.c
@@ -63,6 +63,7 @@ int PQCLEAN_FRODOKEM1344AES_OPT_mul_add_as_plus_e(uint16_t *out, const uint16_t
             out[(i + 3)*PARAMS_NBAR + k] += sum[3];
         }
     }
+    aes128_ctx_release(&ctx128);
     return 1;
 }
 
@@ -121,5 +122,6 @@ int PQCLEAN_FRODOKEM1344AES_OPT_mul_add_sa_plus_e(uint16_t *out, const uint16_t
             }
         }
     }
+    aes128_ctx_release(&ctx128);
     return 1;
 }
diff --git a/crypto_kem/frodokem640aes/clean/matrix_aes.c b/crypto_kem/frodokem640aes/clean/matrix_aes.c
index 65344e3d..1858b754 100644
--- a/crypto_kem/frodokem640aes/clean/matrix_aes.c
+++ b/crypto_kem/frodokem640aes/clean/matrix_aes.c
@@ -33,6 +33,7 @@ int PQCLEAN_FRODOKEM640AES_CLEAN_mul_add_as_plus_e(uint16_t *out, const uint16_t
     }
 
     aes128_ecb((uint8_t *) A, (uint8_t *) A, PARAMS_N * PARAMS_N * sizeof(int16_t) / AES_BLOCKBYTES, &ctx128);
+    aes128_ctx_release(&ctx128);
 
     for (i = 0; i < PARAMS_N * PARAMS_N; i++) {
         A[i] = PQCLEAN_FRODOKEM640AES_CLEAN_LE_TO_UINT16(A[i]);
@@ -73,6 +74,7 @@ int PQCLEAN_FRODOKEM640AES_CLEAN_mul_add_sa_plus_e(uint16_t *out, const uint16_t
     }
 
     aes128_ecb((uint8_t *) A, (uint8_t *) A, PARAMS_N * PARAMS_N * sizeof(int16_t) / AES_BLOCKBYTES, &ctx128);
+    aes128_ctx_release(&ctx128);
 
     for (i = 0; i < PARAMS_N * PARAMS_N; i++) {
         A[i] = PQCLEAN_FRODOKEM640AES_CLEAN_LE_TO_UINT16(A[i]);
diff --git a/crypto_kem/frodokem640aes/opt/matrix_aes.c b/crypto_kem/frodokem640aes/opt/matrix_aes.c
index 24372876..2c03ead3 100644
--- a/crypto_kem/frodokem640aes/opt/matrix_aes.c
+++ b/crypto_kem/frodokem640aes/opt/matrix_aes.c
@@ -63,6 +63,7 @@ int PQCLEAN_FRODOKEM640AES_OPT_mul_add_as_plus_e(uint16_t *out, const uint16_t *
             out[(i + 3)*PARAMS_NBAR + k] += sum[3];
         }
     }
+    aes128_ctx_release(&ctx128);
     return 1;
 }
 
@@ -121,5 +122,6 @@ int PQCLEAN_FRODOKEM640AES_OPT_mul_add_sa_plus_e(uint16_t *out, const uint16_t *
             }
         }
     }
+    aes128_ctx_release(&ctx128);
     return 1;
 }
diff --git a/crypto_kem/frodokem976aes/clean/matrix_aes.c b/crypto_kem/frodokem976aes/clean/matrix_aes.c
index 2596fc25..f02ffb70 100644
--- a/crypto_kem/frodokem976aes/clean/matrix_aes.c
+++ b/crypto_kem/frodokem976aes/clean/matrix_aes.c
@@ -33,6 +33,7 @@ int PQCLEAN_FRODOKEM976AES_CLEAN_mul_add_as_plus_e(uint16_t *out, const uint16_t
     }
 
     aes128_ecb((uint8_t *) A, (uint8_t *) A, PARAMS_N * PARAMS_N * sizeof(int16_t) / AES_BLOCKBYTES, &ctx128);
+    aes128_ctx_release(&ctx128);
 
     for (i = 0; i < PARAMS_N * PARAMS_N; i++) {
         A[i] = PQCLEAN_FRODOKEM976AES_CLEAN_LE_TO_UINT16(A[i]);
@@ -73,6 +74,7 @@ int PQCLEAN_FRODOKEM976AES_CLEAN_mul_add_sa_plus_e(uint16_t *out, const uint16_t
     }
 
     aes128_ecb((uint8_t *) A, (uint8_t *) A, PARAMS_N * PARAMS_N * sizeof(int16_t) / AES_BLOCKBYTES, &ctx128);
+    aes128_ctx_release(&ctx128);
 
     for (i = 0; i < PARAMS_N * PARAMS_N; i++) {
         A[i] = PQCLEAN_FRODOKEM976AES_CLEAN_LE_TO_UINT16(A[i]);
diff --git a/crypto_kem/frodokem976aes/opt/matrix_aes.c b/crypto_kem/frodokem976aes/opt/matrix_aes.c
index a1332fc1..d703af93 100644
--- a/crypto_kem/frodokem976aes/opt/matrix_aes.c
+++ b/crypto_kem/frodokem976aes/opt/matrix_aes.c
@@ -63,6 +63,7 @@ int PQCLEAN_FRODOKEM976AES_OPT_mul_add_as_plus_e(uint16_t *out, const uint16_t *
             out[(i + 3)*PARAMS_NBAR + k] += sum[3];
         }
     }
+    aes128_ctx_release(&ctx128);
     return 1;
 }
 
@@ -121,5 +122,6 @@ int PQCLEAN_FRODOKEM976AES_OPT_mul_add_sa_plus_e(uint16_t *out, const uint16_t *
             }
         }
     }
+    aes128_ctx_release(&ctx128);
     return 1;
 }
diff --git a/crypto_kem/ledakemlt12/leaktime/rng.c b/crypto_kem/ledakemlt12/leaktime/rng.c
index 6d7604e6..a827a4e0 100644
--- a/crypto_kem/ledakemlt12/leaktime/rng.c
+++ b/crypto_kem/ledakemlt12/leaktime/rng.c
@@ -103,6 +103,7 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char
         }
 
     }
+    aes256_ctx_release(&ctx256);
 
     return RNG_SUCCESS;
 }
diff --git a/crypto_kem/ledakemlt32/leaktime/rng.c b/crypto_kem/ledakemlt32/leaktime/rng.c
index 4e18fa57..23e2a63d 100644
--- a/crypto_kem/ledakemlt32/leaktime/rng.c
+++ b/crypto_kem/ledakemlt32/leaktime/rng.c
@@ -103,6 +103,7 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char
         }
 
     }
+    aes256_ctx_release(&ctx256);
 
     return RNG_SUCCESS;
 }
diff --git a/crypto_kem/ledakemlt52/leaktime/rng.c b/crypto_kem/ledakemlt52/leaktime/rng.c
index b9f6c255..c309c0fc 100644
--- a/crypto_kem/ledakemlt52/leaktime/rng.c
+++ b/crypto_kem/ledakemlt52/leaktime/rng.c
@@ -103,6 +103,7 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char
         }
 
     }
+    aes256_ctx_release(&ctx256);
 
     return RNG_SUCCESS;
 }
diff --git a/test/common/aes.c b/test/common/aes.c
index d7759168..9209a42a 100644
--- a/test/common/aes.c
+++ b/test/common/aes.c
@@ -96,5 +96,9 @@ int main(void)
     r = 1;
   }
 
+  aes128_ctx_release(&ctx128);
+  aes192_ctx_release(&ctx192);
+  aes256_ctx_release(&ctx256);
+
   return r;
 }

From d7f745a0e63443e96a80009e39bb3f6ad6f21440 Mon Sep 17 00:00:00 2001
From: Douglas Stebila <dstebila@uwaterloo.ca>
Date: Tue, 25 Jun 2019 09:38:24 -0400
Subject: [PATCH 3/5] Alternative no-op

---
 common/aes.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/common/aes.c b/common/aes.c
index a46efcb7..4d365fd5 100644
--- a/common/aes.c
+++ b/common/aes.c
@@ -622,21 +622,18 @@ void aes256_ctr(unsigned char *out, size_t outlen, const unsigned char *iv, cons
     aes_ctr(out, outlen, iv, ctx->sk_exp, 14);
 }
 
-#ifdef __GNUC__
-#  define UNUSED(x) UNUSED_ ## x __attribute__((__unused__))
-#else
-#  define UNUSED(x) UNUSED_ ## x
-#endif
-
-void aes128_ctx_release(aes128ctx *UNUSED(r)) {
+void aes128_ctx_release(aes128ctx *r) {
     // no-op for PQClean's basic AES operation
+    (void) r;
 }
 
-void aes192_ctx_release(aes192ctx *UNUSED(r)) {
+void aes192_ctx_release(aes192ctx *r) {
     // no-op for PQClean's basic AES operation
+    (void) r;
 }
 
-void aes256_ctx_release(aes256ctx *UNUSED(r)) {
+void aes256_ctx_release(aes256ctx *r) {
     // no-op for PQClean's basic AES operation
+    (void) r;
 }
 

From f21a1b7e24357f031ad730ccb6120e86af47e215 Mon Sep 17 00:00:00 2001
From: Douglas Stebila <dstebila@uwaterloo.ca>
Date: Tue, 25 Jun 2019 09:47:24 -0400
Subject: [PATCH 4/5] Document AES key schedule release

[skip ci]
---
 CONTRIBUTING.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index dd20366b..382cbe6f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -57,6 +57,7 @@ See the section [API](#API) below.
     astyle --project crypto_kem/yourschemename/clean/*.[ch]
     ```
     4. You may run the tests in the `tests/` folder. See the `README` for how to run the test suite.
+    5. Migrate your use of AES, SHA-2, and SHA-3 to the API in the `common` directory. Note that if you use the AES API, you must use the `aes128_keyexp` routine (or 192 or 256) to expand the key into a key schedule object, then use `aes128_ctx_release` to release the key schedule object once you're finished with it.
 
 5. Create `Makefile` and `Makefile.Microsoft_nmake` files to compile your scheme as static library.
     * We suggest you copy these from `crypto_kem/kyber768/clean` and modify them to suit your scheme.

From f041450262737010f40bea41adbc66a1ad487768 Mon Sep 17 00:00:00 2001
From: Douglas Stebila <dstebila@uwaterloo.ca>
Date: Wed, 26 Jun 2019 09:58:05 -0400
Subject: [PATCH 5/5] Trivial commit to trigger a rerun of all CI.

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 3f9af715..aa8aeda9 100644
--- a/README.md
+++ b/README.md
@@ -130,7 +130,7 @@ Their integration strategies may serve as examples for your own projects.
 
 - **[pqcrypto crate](https://github.com/rustpq/pqcrypto)**: Rust integration that automatically generates wrappers from PQClean source code.
 - **[mupq](https://github.com/mupq/)**: Runs the implementations from PQClean as reference implementations to compare with microcontroller-optimized code.
-- **[Open Quantum Safe](https://github.com/open-quantum-safe/)**: The Open Quantum Safe project integrates implementations from PQClean into their [liboqs](https://github.com/open-quantum-safe/liboqs) C library, which then exposes them via [C++](https://github.com/open-quantum-safe/liboqs-cpp), [C# / .NET](https://github.com/open-quantum-safe/liboqs-dotnet), and [Python](https://github.com/open-quantum-safe/liboqs-python) wrappers, as well as to forks of [OpenSSL](https://github.com/open-quantum-safe/openssl) and [OpenSSH](https://github.com/open-quantum-safe/openssh-portable).
+- **[Open Quantum Safe](https://github.com/open-quantum-safe/)**: The Open Quantum Safe project integrates implementations from PQClean into their [liboqs](https://github.com/open-quantum-safe/liboqs/) C library, which then exposes them via [C++](https://github.com/open-quantum-safe/liboqs-cpp), [C# / .NET](https://github.com/open-quantum-safe/liboqs-dotnet), and [Python](https://github.com/open-quantum-safe/liboqs-python) wrappers, as well as to forks of [OpenSSL](https://github.com/open-quantum-safe/openssl) and [OpenSSH](https://github.com/open-quantum-safe/openssh-portable).
 
 ## License