diff --git a/common/fips202.c b/common/fips202.c index 0fb29fab..794e25a0 100644 --- a/common/fips202.c +++ b/common/fips202.c @@ -718,6 +718,49 @@ void sha3_256(uint8_t *output, const uint8_t *input, size_t inlen) { } } +void sha3_384_inc_init(sha3_384incctx *state) { + keccak_inc_init(state->ctx); +} + +void sha3_384_inc_absorb(sha3_384incctx *state, const uint8_t *input, size_t inlen) { + keccak_inc_absorb(state->ctx, SHA3_384_RATE, input, inlen); +} + +void sha3_384_inc_finalize(uint8_t *output, sha3_384incctx *state) { + uint8_t t[SHA3_384_RATE]; + keccak_inc_finalize(state->ctx, SHA3_384_RATE, 0x06); + + keccak_squeezeblocks(t, 1, state->ctx, SHA3_384_RATE); + + for (size_t i = 0; i < 48; i++) { + output[i] = t[i]; + } +} + +/************************************************* + * Name: sha3_384 + * + * Description: SHA3-256 with non-incremental API + * + * Arguments: - uint8_t *output: pointer to output + * - const uint8_t *input: pointer to input + * - size_t inlen: length of input in bytes + **************************************************/ +void sha3_384(uint8_t *output, const uint8_t *input, size_t inlen) { + uint64_t s[25]; + uint8_t t[SHA3_384_RATE]; + + /* Absorb input */ + keccak_absorb(s, SHA3_384_RATE, input, inlen, 0x06); + + /* Squeeze output */ + keccak_squeezeblocks(t, 1, s, SHA3_384_RATE); + + for (size_t i = 0; i < 48; i++) { + output[i] = t[i]; + } +} + void sha3_512_inc_init(sha3_512incctx *state) { keccak_inc_init(state->ctx); } diff --git a/common/fips202.h b/common/fips202.h index 622d736a..5d62b284 100644 --- a/common/fips202.h +++ b/common/fips202.h @@ -7,6 +7,7 @@ #define SHAKE128_RATE 168 #define SHAKE256_RATE 136 #define SHA3_256_RATE 136 +#define SHA3_384_RATE 104 #define SHA3_512_RATE 72 @@ -35,6 +36,11 @@ typedef struct { uint64_t ctx[26]; } sha3_256incctx; +// Context for incremental API +typedef struct { + uint64_t ctx[26]; +} sha3_384incctx; + // Context for incremental API typedef struct { uint64_t ctx[26]; @@ -69,6 +75,12 @@ void sha3_256_inc_finalize(uint8_t *output, sha3_256incctx *state); void sha3_256(uint8_t *output, const uint8_t *input, size_t inlen); +void sha3_384_inc_init(sha3_384incctx *state); +void sha3_384_inc_absorb(sha3_384incctx *state, const uint8_t *input, size_t inlen); +void sha3_384_inc_finalize(uint8_t *output, sha3_384incctx *state); + +void sha3_384(uint8_t *output, const uint8_t *input, size_t inlen); + void sha3_512_inc_init(sha3_512incctx *state); void sha3_512_inc_absorb(sha3_512incctx *state, const uint8_t *input, size_t inlen); void sha3_512_inc_finalize(uint8_t *output, sha3_512incctx *state); diff --git a/crypto_kem/ledakemlt12/META.yml b/crypto_kem/ledakemlt12/META.yml new file mode 100644 index 00000000..1ec944a7 --- /dev/null +++ b/crypto_kem/ledakemlt12/META.yml @@ -0,0 +1,18 @@ +name: LEDAcryptKEMLT12 +type: kem +claimed-nist-level: 1 +claimed-security: IND-CCA2 +length-public-key: 6520 +length-secret-key: 26 +length-ciphertext: 6520 +length-shared-secret: 32 +nistkat-sha256: c49a3f0ff5f3e7d6b41995649d7003daf7c06d9539fc28cb3b93ed02dcbe09d4 +principal-submitter: Marco Baldi +auxiliary-submitters: + - Alessandro Barenghi + - Franco Chiaraluce + - Gerardo Pelosi + - Paolo Santini +implementations: + - name: leaktime + version: 2.? diff --git a/crypto_kem/ledakemlt12/leaktime/H_Q_matrices_generation.c b/crypto_kem/ledakemlt12/leaktime/H_Q_matrices_generation.c new file mode 100644 index 00000000..70a9727a --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/H_Q_matrices_generation.c @@ -0,0 +1,32 @@ +#include "H_Q_matrices_generation.h" +#include "gf2x_arith_mod_xPplusOne.h" + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes_HtrPosOnes( + POSITION_T HPosOnes[N0][DV], + POSITION_T HtrPosOnes[N0][DV], + AES_XOF_struct *keys_expander) { + for (int i = 0; i < N0; i++) { + /* Generate a random block of Htr */ + PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&HtrPosOnes[i][0], DV, keys_expander); + } + for (int i = 0; i < N0; i++) { + /* Obtain directly the sparse representation of the block of H */ + for (int k = 0; k < DV; k++) { + HPosOnes[i][k] = (P - HtrPosOnes[i][k]) % P; /* transposes indexes */ + } + } +} + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQsparse( + POSITION_T pos_ones[N0][M], + AES_XOF_struct *keys_expander) { + for (int i = 0; i < N0; i++) { + int placed_ones = 0; + for (int j = 0; j < N0; j++) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&pos_ones[i][placed_ones], + qBlockWeights[i][j], + keys_expander); + placed_ones += qBlockWeights[i][j]; + } + } +} diff --git a/crypto_kem/ledakemlt12/leaktime/H_Q_matrices_generation.h b/crypto_kem/ledakemlt12/leaktime/H_Q_matrices_generation.h new file mode 100644 index 00000000..0bf43055 --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/H_Q_matrices_generation.h @@ -0,0 +1,11 @@ +#ifndef H_Q_MATRICES_GENERATION_H +#define H_Q_MATRICES_GENERATION_H + +#include "gf2x_arith.h" +#include "qc_ldpc_parameters.h" +#include "rng.h" + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes_HtrPosOnes(POSITION_T HPosOnes[N0][DV], POSITION_T HtrPosOnes[N0][DV], AES_XOF_struct *niederreiter_keys_expander); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQsparse(POSITION_T pos_ones[N0][M], AES_XOF_struct *niederreiter_keys_expander); + +#endif diff --git a/crypto_kem/ledakemlt12/leaktime/LICENSE b/crypto_kem/ledakemlt12/leaktime/LICENSE new file mode 100644 index 00000000..c1761078 --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/LICENSE @@ -0,0 +1,31 @@ +/** + * + * LEDAcryptKEM + * + * @version 2.0 (March 2019) + * + * Adapted code from reference ISO-C11 Implementation of the LEDAcrypt KEM-LT cipher. + * + * In alphabetical order: + * + * @author Marco Baldi + * @author Alessandro Barenghi + * @author Franco Chiaraluce + * @author Gerardo Pelosi + * @author Paolo Santini + * + * This code is hereby placed in the public domain. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS + * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE + * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, + * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + **/ diff --git a/crypto_kem/ledakemlt12/leaktime/Makefile b/crypto_kem/ledakemlt12/leaktime/Makefile new file mode 100644 index 00000000..09326171 --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/Makefile @@ -0,0 +1,24 @@ +# This Makefile can be used with GNU Make or BSD Make + +LIB=libledakemlt12_leaktime.a +HEADERS=api.h bf_decoding.h dfr_test.h gf2x_arith_mod_xPplusOne.h \ + gf2x_arith.h H_Q_matrices_generation.h \ + niederreiter.h qc_ldpc_parameters.h rng.h + +OBJECTS=bf_decoding.o dfr_test.o gf2x_arith_mod_xPplusOne.o \ + gf2x_arith.o H_Q_matrices_generation.o kem.o niederreiter.o rng.o + +CFLAGS=-O3 -Wall -Werror -Wextra -Wvla -Wpedantic -Wmissing-prototypes -std=c99 \ + -I../../../common $(EXTRAFLAGS) + +all: $(LIB) + +%.o: %.c $(HEADERS) + $(CC) $(CFLAGS) -c -o $@ $< + +$(LIB): $(OBJECTS) + $(AR) -r $@ $(OBJECTS) + +clean: + $(RM) $(OBJECTS) + $(RM) $(LIB) diff --git a/crypto_kem/ledakemlt12/leaktime/Makefile.Microsoft_nmake b/crypto_kem/ledakemlt12/leaktime/Makefile.Microsoft_nmake new file mode 100644 index 00000000..fbad677a --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/Makefile.Microsoft_nmake @@ -0,0 +1,19 @@ +# This Makefile can be used with Microsoft Visual Studio's nmake using the command: +# nmake /f Makefile.Microsoft_nmake + +LIBRARY=libledakemlt12_leaktime.lib +OBJECTS=bf_decoding.obj dfr_test.obj gf2x_arith_mod_xPplusOne.obj gf2x_arith.obj H_Q_matrices_generation.obj kem.obj niederreiter.obj rng.obj + +CFLAGS=/nologo /I ..\..\..\common /W4 /WX + +all: $(LIBRARY) + +# Make sure objects are recompiled if headers change. +$(OBJECTS): *.h + +$(LIBRARY): $(OBJECTS) + LIB.EXE /NOLOGO /WX /OUT:$@ $** + +clean: + -DEL $(OBJECTS) + -DEL $(LIBRARY) diff --git a/crypto_kem/ledakemlt12/leaktime/api.h b/crypto_kem/ledakemlt12/leaktime/api.h new file mode 100644 index 00000000..fd2f6b8b --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/api.h @@ -0,0 +1,18 @@ +#ifndef PQCLEAN_LEDAKEMLT12_LEAKTIME_API_H +#define PQCLEAN_LEDAKEMLT12_LEAKTIME_API_H + +#include + +#define PQCLEAN_LEDAKEMLT12_LEAKTIME_CRYPTO_SECRETKEYBYTES 26 +#define PQCLEAN_LEDAKEMLT12_LEAKTIME_CRYPTO_PUBLICKEYBYTES 6520 +#define PQCLEAN_LEDAKEMLT12_LEAKTIME_CRYPTO_CIPHERTEXTBYTES 6520 +#define PQCLEAN_LEDAKEMLT12_LEAKTIME_CRYPTO_BYTES 32 + +#define PQCLEAN_LEDAKEMLT12_LEAKTIME_CRYPTO_ALGNAME "LEDAKEMLT12" + +int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_keypair(uint8_t *pk, uint8_t *sk); +int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk); +int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk); + + +#endif diff --git a/crypto_kem/ledakemlt12/leaktime/bf_decoding.c b/crypto_kem/ledakemlt12/leaktime/bf_decoding.c new file mode 100644 index 00000000..f095b7e7 --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/bf_decoding.c @@ -0,0 +1,76 @@ +#include "bf_decoding.h" +#include "gf2x_arith_mod_xPplusOne.h" + +#include + +int PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(DIGIT err[], + const POSITION_T HtrPosOnes[N0][DV], + const POSITION_T QtrPosOnes[N0][M], + DIGIT privateSyndrome[], + uint8_t threshold) { + + uint8_t unsatParityChecks[N0 * P]; + POSITION_T currQBlkPos[M], currQBitPos[M]; + DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; + int check; + int iteration = 0; + unsigned int corrt_syndrome_based; + + do { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); + memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); + for (int i = 0; i < N0; i++) { + for (int valueIdx = 0; valueIdx < P; valueIdx++) { + for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { + POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx); + if (PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { + unsatParityChecks[i * P + valueIdx]++; + } + } + } + } + + /* iteration based threshold determination*/ + corrt_syndrome_based = iteration ? (unsigned int) threshold : B0; + + //Computation of correlation with a full Q matrix + for (int i = 0; i < N0; i++) { + for (int j = 0; j < P; j++) { + int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] + int endQblockIdx = 0; + unsigned int correlation = 0; + + for (int blockIdx = 0; blockIdx < N0; blockIdx++) { + endQblockIdx += qBlockWeights[blockIdx][i]; + int currblockoffset = blockIdx * P; + for (; currQoneIdx < endQblockIdx; currQoneIdx++) { + POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j; + tmp = tmp >= P ? tmp - P : tmp; + currQBitPos[currQoneIdx] = tmp; + currQBlkPos[currQoneIdx] = blockIdx; + correlation += unsatParityChecks[tmp + currblockoffset]; + } + } + /* Correlation based flipping */ + if (correlation >= corrt_syndrome_based) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); + for (int v = 0; v < M; v++) { + POSITION_T syndromePosToFlip; + for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { + syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] ); + syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); + } + } // end for v + } // end if + } // end for j + } // end for i + + iteration = iteration + 1; + check = 0; + while (check < NUM_DIGITS_GF2X_ELEMENT && privateSyndrome[check++] == 0) {}; + + } while (iteration < ITERATIONS_MAX && check < NUM_DIGITS_GF2X_ELEMENT); + + return (check == NUM_DIGITS_GF2X_ELEMENT); +} diff --git a/crypto_kem/ledakemlt12/leaktime/bf_decoding.h b/crypto_kem/ledakemlt12/leaktime/bf_decoding.h new file mode 100644 index 00000000..6c62f4b3 --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/bf_decoding.h @@ -0,0 +1,18 @@ +#ifndef BF_DECODING_H +#define BF_DECODING_H + +#include "gf2x_arith.h" +#include "qc_ldpc_parameters.h" + +/* Definitions for DFR level 2^-SL with SL=128 */ +#define ITERATIONS_MAX (2) +#define B0 (43) +#define T_BAR (4) + +int PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(DIGIT err[], + const POSITION_T HtrPosOnes[N0][DV], + const POSITION_T QtrPosOnes[N0][M], + DIGIT privateSyndrome[], + uint8_t threshold); // B2 + +#endif diff --git a/crypto_kem/ledakemlt12/leaktime/dfr_test.c b/crypto_kem/ledakemlt12/leaktime/dfr_test.c new file mode 100644 index 00000000..9ea239a9 --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/dfr_test.c @@ -0,0 +1,112 @@ +#include "bf_decoding.h" +#include "dfr_test.h" +#include "gf2x_arith_mod_xPplusOne.h" +#include "qc_ldpc_parameters.h" + +#include + +/* Tests if the current code attains the desired DFR. If that is the case, + * computes the threshold for the second iteration of the decoder and returns this values + * (max DV * M), on failure it returns 255 >> DV * M */ + +uint8_t PQCLEAN_LEDAKEMLT12_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M]) { + + POSITION_T LSparse_loc[N0][DV * M]; + POSITION_T rotated_column[DV * M]; + /* Gamma matrix: an N0 x N0 block circulant matrix with block size p + * gamma[a][b][c] stores the intersection of the first column of the a-th + * block of L with the c-th column of the b-th block of L. + * Gamma computation can be accelerated employing symmetry and QC properties */ + unsigned int gamma[N0][N0][P] = {{{0}}}; + unsigned int gammaHist[N0][DV * M + 1] = {{0}}; + unsigned int maxMut[N0], maxMutMinusOne[N0]; + unsigned int firstidx, secondidx, intersectionval; + unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; + unsigned int toAdd, histIdx; + + /*transpose blocks of L, we need its columns */ + for (int i = 0; i < N0; i++) { + for (int j = 0; j < DV * M; j++) { + if (LSparse[i][j] != 0) { + LSparse_loc[i][j] = (P - LSparse[i][j]); + } + } + PQCLEAN_LEDAKEMLT12_LEAKTIME_quicksort_sparse(LSparse_loc[i]); + } + + for (int i = 0; i < N0; i++ ) { + for (int j = 0; j < N0; j++ ) { + for (int k = 0; k < P; k++) { + /* compute the rotated sparse column needed */ + for (int idxToRotate = 0; idxToRotate < (DV * M); idxToRotate++) { + rotated_column[idxToRotate] = (LSparse_loc[j][idxToRotate] + k) % P; + } + PQCLEAN_LEDAKEMLT12_LEAKTIME_quicksort_sparse(rotated_column); + /* compute the intersection amount */ + firstidx = 0, secondidx = 0; + intersectionval = 0; + while ( (firstidx < DV * M) && (secondidx < DV * M) ) { + if ( LSparse_loc[i][firstidx] == rotated_column[secondidx] ) { + intersectionval++; + firstidx++; + secondidx++; + } else if ( LSparse_loc[i][firstidx] > rotated_column[secondidx] ) { + secondidx++; + } else { /*if ( LSparse_loc[i][firstidx] < rotated_column[secondidx] ) */ + firstidx++; + } + } + gamma[i][j][k] = intersectionval; + + } + } + } + for (int i = 0; i < N0; i++ ) { + for (int j = 0; j < N0; j++ ) { + gamma[i][j][0] = 0; + } + } + /* build histogram of values in gamma */ + for (int i = 0; i < N0; i++ ) { + for (int j = 0; j < N0; j++ ) { + for (int k = 0; k < P; k++) { + gammaHist[i][gamma[i][j][k]]++; + } + } + } + + + for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { + toAdd = T_BAR - 1; + maxMutMinusOne[gammaBlockRowIdx] = 0; + histIdx = DV * M; + while ( (histIdx > 0) && (toAdd > 0)) { + if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { + maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; + toAdd = 0; + } else { + maxMutMinusOne[gammaBlockRowIdx] += histIdx * gammaHist[gammaBlockRowIdx][histIdx]; + toAdd -= gammaHist[gammaBlockRowIdx][histIdx]; + histIdx--; + } + } + maxMut[gammaBlockRowIdx] = histIdx + maxMutMinusOne[gammaBlockRowIdx]; + } + + + /*seek max values across all gamma blocks */ + allBlockMaxSumst = maxMut[0]; + allBlockMaxSumstMinusOne = maxMutMinusOne[0]; + for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { + allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? + maxMut[gammaBlockRowIdx] : + allBlockMaxSumst; + allBlockMaxSumstMinusOne = allBlockMaxSumstMinusOne < maxMutMinusOne[gammaBlockRowIdx] ? + maxMutMinusOne[gammaBlockRowIdx] : + allBlockMaxSumstMinusOne; + } + if (DV * M > (allBlockMaxSumstMinusOne + allBlockMaxSumst)) { + return (uint8_t) allBlockMaxSumst + 1; + } + return DFR_TEST_FAIL; +} diff --git a/crypto_kem/ledakemlt12/leaktime/dfr_test.h b/crypto_kem/ledakemlt12/leaktime/dfr_test.h new file mode 100644 index 00000000..39673efb --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/dfr_test.h @@ -0,0 +1,8 @@ +#ifndef DFR_TEST_H +#define DFR_TEST_H + +#define DFR_TEST_FAIL (255) + +uint8_t PQCLEAN_LEDAKEMLT12_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M]); + +#endif diff --git a/crypto_kem/ledakemlt12/leaktime/gf2x_arith.c b/crypto_kem/ledakemlt12/leaktime/gf2x_arith.c new file mode 100644 index 00000000..a7799825 --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/gf2x_arith.c @@ -0,0 +1,73 @@ +#include "gf2x_arith.h" + +#include // memset(...) + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_add(DIGIT Res[], const DIGIT A[], const DIGIT B[], int nr) { + for (int i = 0; i < nr; i++) { + Res[i] = A[i] ^ B[i]; + } +} + +/* PRE: MAX ALLOWED ROTATION AMOUNT : DIGIT_SIZE_b */ +void PQCLEAN_LEDAKEMLT12_LEAKTIME_right_bit_shift_n(int length, DIGIT in[], unsigned int amount) { + if ( amount == 0 ) { + return; + } + unsigned int j; + DIGIT mask; + mask = ((DIGIT)0x01 << amount) - 1; + for (j = length - 1; j > 0 ; j--) { + in[j] >>= amount; + in[j] |= (in[j - 1] & mask) << (DIGIT_SIZE_b - amount); + } + in[j] >>= amount; +} + +/* PRE: MAX ALLOWED ROTATION AMOUNT : DIGIT_SIZE_b */ +void PQCLEAN_LEDAKEMLT12_LEAKTIME_left_bit_shift_n(int length, DIGIT in[], unsigned int amount) { + if ( amount == 0 ) { + return; + } + int j; + DIGIT mask; + mask = ~(((DIGIT)0x01 << (DIGIT_SIZE_b - amount)) - 1); + for (j = 0 ; j < length - 1 ; j++) { + in[j] <<= amount; + in[j] |= (in[j + 1] & mask) >> (DIGIT_SIZE_b - amount); + } + in[j] <<= amount; +} + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mul_comb(int nr, DIGIT Res[], + int na, const DIGIT A[], + int nb, const DIGIT B[]) { + int i, j, k; + DIGIT u, h; + + memset(Res, 0x00, nr * sizeof(DIGIT)); + + for (k = DIGIT_SIZE_b - 1; k > 0; k--) { + for (i = na - 1; i >= 0; i--) { + if ( A[i] & (((DIGIT)0x1) << k) ) { + for (j = nb - 1; j >= 0; j--) { + Res[i + j + 1] ^= B[j]; + } + } + } + + u = Res[na + nb - 1]; + Res[na + nb - 1] = u << 0x1; + for (j = 1; j < na + nb; ++j) { + h = u >> (DIGIT_SIZE_b - 1); + u = Res[na + nb - 1 - j]; + Res[na + nb - 1 - j] = h ^ (u << 0x1); + } + } + for (i = na - 1; i >= 0; i--) { + if ( A[i] & ((DIGIT)0x1) ) { + for (j = nb - 1; j >= 0; j--) { + Res[i + j + 1] ^= B[j]; + } + } + } +} diff --git a/crypto_kem/ledakemlt12/leaktime/gf2x_arith.h b/crypto_kem/ledakemlt12/leaktime/gf2x_arith.h new file mode 100644 index 00000000..3851fb7f --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/gf2x_arith.h @@ -0,0 +1,58 @@ +#ifndef GF2X_ARITH_H +#define GF2X_ARITH_H + +#include +#include + +/* + * Elements of GF(2)[x] are stored in compact dense binary form. + * + * Each bit in a byte is assumed to be the coefficient of a binary + * polynomial f(x), in Big-Endian format (i.e., reading everything from + * left to right, the most significant element is met first): + * + * byte:(0000 0000) == 0x00 ... f(x) == 0 + * byte:(0000 0001) == 0x01 ... f(x) == 1 + * byte:(0000 0010) == 0x02 ... f(x) == x + * byte:(0000 0011) == 0x03 ... f(x) == x+1 + * ... ... ... + * byte:(0000 1111) == 0x0F ... f(x) == x^{3}+x^{2}+x+1 + * ... ... ... + * byte:(1111 1111) == 0xFF ... f(x) == x^{7}+x^{6}+x^{5}+x^{4}+x^{3}+x^{2}+x+1 + * + * + * A "machine word" (A_i) is considered as a DIGIT. + * Bytes in a DIGIT are assumed in Big-Endian format: + * E.g., if sizeof(DIGIT) == 4: + * A_i: A_{i,3} A_{i,2} A_{i,1} A_{i,0}. + * A_{i,3} denotes the most significant byte, A_{i,0} the least significant one. + * f(x) == x^{31} + ... + x^{24} + + * + x^{23} + ... + x^{16} + + * + x^{15} + ... + x^{8} + + * + x^{7} + ... + x^{0} + * + * + * Multi-precision elements (i.e., with multiple DIGITs) are stored in + * Big-endian format: + * A = A_{n-1} A_{n-2} ... A_1 A_0 + * + * position[A_{n-1}] == 0 + * position[A_{n-2}] == 1 + * ... + * position[A_{1}] == n-2 + * position[A_{0}] == n-1 + */ + +typedef uint64_t DIGIT; +#define DIGIT_SIZE_B (8) +#define DIGIT_SIZE_b (DIGIT_SIZE_B << 3) +#define POSITION_T uint32_t + +#define GF2X_MUL PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mul_comb + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_add(DIGIT Res[], const DIGIT A[], const DIGIT B[], int nr); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_right_bit_shift_n(int length, DIGIT in[], unsigned int amount); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_left_bit_shift_n(int length, DIGIT in[], unsigned int amount); +void GF2X_MUL(int nr, DIGIT Res[], int na, const DIGIT A[], int nb, const DIGIT B[]); + +#endif diff --git a/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.c b/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.c new file mode 100644 index 00000000..b2de57d4 --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.c @@ -0,0 +1,583 @@ +#include "gf2x_arith_mod_xPplusOne.h" +#include "rng.h" + +#include // memcpy(...), memset(...) + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { + for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { + dest[i] = in[i]; + } +} + +/* returns the coefficient of the x^exponent term as the LSB of a digit */ +DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) { + unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; + unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; + return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; +} + +/* sets the coefficient of the x^exponent term as the LSB of a digit */ +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) { + unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; + unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; + + /* clear given coefficient */ + DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + poly[digitIdx] = poly[digitIdx] & mask; + poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); +} + +/* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) { + unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; + unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; + + /* clear given coefficient */ + DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + poly[digitIdx] = poly[digitIdx] ^ mask; +} + +/* population count for an unsigned 64-bit integer + Source: Hacker's delight, p.66 */ +static int popcount_uint64t(uint64_t x) { + x -= (x >> 1) & 0x5555555555555555; + x = (x & 0x3333333333333333) + ((x >> 2) & 0x3333333333333333); + x = (x + (x >> 4)) & 0x0f0f0f0f0f0f0f0f; + return (int)((x * 0x0101010101010101) >> 56); +} + +/* population count for a single polynomial */ +int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(DIGIT *poly) { + int ret = 0; + for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { + ret += popcount_uint64t(poly[i]); + } + return ret; +} + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_add(Res, A, B, NUM_DIGITS_GF2X_ELEMENT); +} + +static int partition(POSITION_T arr[], int lo, int hi) { + POSITION_T x = arr[hi]; + POSITION_T tmp; + int i = (lo - 1); + for (int j = lo; j <= hi - 1; j++) { + if (arr[j] <= x) { + i++; + tmp = arr[i]; + arr[i] = arr[j]; + arr[j] = tmp; + } + } + tmp = arr[i + 1]; + arr[i + 1] = arr[hi]; + arr[hi] = tmp; + + return i + 1; +} + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_quicksort_sparse(POSITION_T Res[]) { + int stack[DV * M]; + int hi, lo, pivot, tos = -1; + stack[++tos] = 0; + stack[++tos] = (DV * M) - 1; + while (tos >= 0 ) { + hi = stack[tos--]; + lo = stack[tos--]; + pivot = partition(Res, lo, hi); + if ( (pivot - 1) > lo) { + stack[++tos] = lo; + stack[++tos] = pivot - 1; + } + if ( (pivot + 1) < hi) { + stack[++tos] = pivot + 1; + stack[++tos] = hi; + } + } +} + +static void gf2x_mod(DIGIT out[], const DIGIT in[]) { + + int i, j, posTrailingBit, maskOffset; + DIGIT mask, aux[2 * NUM_DIGITS_GF2X_ELEMENT]; + + memcpy(aux, in, 2 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + memset(out, 0x00, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + + for (i = 0; i < (2 * NUM_DIGITS_GF2X_ELEMENT) - NUM_DIGITS_GF2X_MODULUS; i += 1) { + for (j = DIGIT_SIZE_b - 1; j >= 0; j--) { + mask = ((DIGIT)0x1) << j; + if (aux[i] & mask) { + aux[i] ^= mask; + posTrailingBit = (DIGIT_SIZE_b - 1 - j) + i * DIGIT_SIZE_b + P; + maskOffset = (DIGIT_SIZE_b - 1 - (posTrailingBit % DIGIT_SIZE_b)); + mask = (DIGIT) 0x1 << maskOffset; + aux[posTrailingBit / DIGIT_SIZE_b] ^= mask; + } + } + } + + for (j = DIGIT_SIZE_b - 1; j >= MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS; j--) { + mask = ((DIGIT)0x1) << j; + if (aux[i] & mask) { + aux[i] ^= mask; + posTrailingBit = (DIGIT_SIZE_b - 1 - j) + i * DIGIT_SIZE_b + P; + maskOffset = (DIGIT_SIZE_b - 1 - (posTrailingBit % DIGIT_SIZE_b)); + mask = (DIGIT) 0x1 << maskOffset; + aux[posTrailingBit / DIGIT_SIZE_b] ^= mask; + } + } + + for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + out[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = aux[2 * NUM_DIGITS_GF2X_ELEMENT - 1 - i]; + } + +} + +static void left_bit_shift(const int length, DIGIT in[]) { + + int j; + for (j = 0; j < length - 1; j++) { + in[j] <<= 1; /* logical shift does not need clearing */ + in[j] |= in[j + 1] >> (DIGIT_SIZE_b - 1); + } + in[j] <<= 1; +} + +static void right_bit_shift(unsigned int length, DIGIT in[]) { + + unsigned int j; + for (j = length - 1; j > 0 ; j--) { + in[j] >>= 1; + in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); + } + in[j] >>= 1; +} + + +/* shifts by whole digits */ +static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) { + unsigned int j; + for (j = 0; (j + amount) < length; j++) { + in[j] = in[j + amount]; + } + for (; j < length; j++) { + in[j] = (DIGIT)0; + } +} + +/* may shift by an arbitrary amount*/ +static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) { + left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); + PQCLEAN_LEDAKEMLT12_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); +} + +/* Hackers delight, reverses a uint64_t */ +static DIGIT reverse_digit(DIGIT x) { + uint64_t t; + x = (x << 31) | (x >> 33); + t = (x ^ (x >> 20)) & 0x00000FFF800007FFLL; + x = (t | (t << 20)) ^ x; + t = (x ^ (x >> 8)) & 0x00F8000F80700807LL; + x = (t | (t << 8)) ^ x; + t = (x ^ (x >> 4)) & 0x0808708080807008LL; + x = (t | (t << 4)) ^ x; + t = (x ^ (x >> 2)) & 0x1111111111111111LL; + x = (t | (t << 2)) ^ x; + return x; +} + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) { + /* it keeps the lsb in the same position and + * inverts the sequence of the remaining bits */ + + DIGIT mask = (DIGIT)0x1; + DIGIT rev1, rev2, a00; + int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; + + a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; + right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); + + for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { + rev1 = reverse_digit(A[i]); + rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); + A[i] = rev2; + A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; + } + + A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]); + + if (slack_bits_amount) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); + } + A[NUM_DIGITS_GF2X_ELEMENT - 1] = (A[NUM_DIGITS_GF2X_ELEMENT - 1] & (~mask)) | a00; +} + +static void rotate_bit_left(DIGIT in[]) { /* equivalent to x * in(x) mod x^P+1 */ + + DIGIT mask, rotated_bit; + int msb_offset_in_digit = MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS - 1; + mask = ((DIGIT)0x1) << msb_offset_in_digit; + rotated_bit = !!(in[0] & mask); + in[0] &= ~mask; + left_bit_shift(NUM_DIGITS_GF2X_ELEMENT, in); + in[NUM_DIGITS_GF2X_ELEMENT - 1] |= rotated_bit; +} + +static void rotate_bit_right(DIGIT in[]) { /* x^{-1} * in(x) mod x^P+1 */ + + DIGIT rotated_bit = in[NUM_DIGITS_GF2X_ELEMENT - 1] & ((DIGIT)0x1); + right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, in); + int msb_offset_in_digit = MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS - 1; + rotated_bit = rotated_bit << msb_offset_in_digit; + in[0] |= rotated_bit; +} + +static void gf2x_swap(const int length, DIGIT f[], DIGIT s[]) { + DIGIT t; + for (int i = length - 1; i >= 0; i--) { + t = f[i]; + f[i] = s[i]; + s[i] = t; + } +} + +/* + * Optimized extended GCD algorithm to compute the multiplicative inverse of + * a non-zero element in GF(2)[x] mod x^P+1, in polyn. representation. + * + * H. Brunner, A. Curiger, and M. Hofstetter. 1993. + * On Computing Multiplicative Inverses in GF(2^m). + * IEEE Trans. Comput. 42, 8 (August 1993), 1010-1015. + * DOI=http://dx.doi.org/10.1109/12.238496 + * + * + * Henri Cohen, Gerhard Frey, Roberto Avanzi, Christophe Doche, Tanja Lange, + * Kim Nguyen, and Frederik Vercauteren. 2012. + * Handbook of Elliptic and Hyperelliptic Curve Cryptography, + * Second Edition (2nd ed.). Chapman & Hall/CRC. + * (Chapter 11 -- Algorithm 11.44 -- pag 223) + * + */ +int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { /* in^{-1} mod x^P-1 */ + + int i; + int delta = 0; + DIGIT u[NUM_DIGITS_GF2X_ELEMENT] = {0}; + DIGIT v[NUM_DIGITS_GF2X_ELEMENT] = {0}; + DIGIT s[NUM_DIGITS_GF2X_MODULUS] = {0}; + DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // alignas(32)? + + DIGIT mask; + u[NUM_DIGITS_GF2X_ELEMENT - 1] = 0x1; + v[NUM_DIGITS_GF2X_ELEMENT - 1] = 0x0; + + s[NUM_DIGITS_GF2X_MODULUS - 1] = 0x1; + + mask = (((DIGIT)0x1) << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); + s[0] |= mask; + + for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0 && in[i] == 0; i--) { }; + if (i < 0) { + return 0; + } + + for (i = NUM_DIGITS_GF2X_MODULUS - 1; i >= 0 ; i--) { + f[i] = in[i]; + } + + for (i = 1; i <= 2 * P; i++) { + if ( (f[0] & mask) == 0 ) { + left_bit_shift(NUM_DIGITS_GF2X_MODULUS, f); + rotate_bit_left(u); + delta += 1; + } else { + if ( (s[0] & mask) != 0) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_add(s, s, f, NUM_DIGITS_GF2X_MODULUS); + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add(v, v, u); + } + left_bit_shift(NUM_DIGITS_GF2X_MODULUS, s); + if ( delta == 0 ) { + gf2x_swap(NUM_DIGITS_GF2X_MODULUS, f, s); + gf2x_swap(NUM_DIGITS_GF2X_ELEMENT, u, v); + rotate_bit_left(u); + delta = 1; + } else { + rotate_bit_right(u); + delta = delta - 1; + } + } + } + + for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0 ; i--) { + out[i] = u[i]; + } + + return (delta == 0); +} + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]) { + + DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT]; + GF2X_MUL(2 * NUM_DIGITS_GF2X_ELEMENT, aux, + NUM_DIGITS_GF2X_ELEMENT, A, + NUM_DIGITS_GF2X_ELEMENT, B); + gf2x_mod(Res, aux); + +} + +/*PRE: the representation of the sparse coefficients is sorted in increasing + order of the coefficients themselves */ +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse( + DIGIT Res[], + const DIGIT dense[], + POSITION_T sparse[], unsigned int nPos) { + + DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; + DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; + memcpy(aux + NUM_DIGITS_GF2X_ELEMENT, dense, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + memcpy(resDouble + NUM_DIGITS_GF2X_ELEMENT, dense, + NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + + if (sparse[0] != INVALID_POS_VALUE) { + left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); + left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); + + for (unsigned int i = 1; i < nPos; i++) { + if (sparse[i] != INVALID_POS_VALUE) { + left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); + } + } + } + + gf2x_mod(Res, resDouble); + +} + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) { + + POSITION_T t; + int i = 0, j; + + if (A[i] == 0) { + i = 1; + } + j = i; + + for (; i < sizeA && A[i] != INVALID_POS_VALUE; i++) { + A[i] = P - A[i]; + } + + for (i -= 1; j < i; j++, i--) { + t = A[j]; + A[j] = A[i]; + A[i] = t; + } + +} + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], + size_t sizeA, const POSITION_T A[], + size_t sizeB, const POSITION_T B[]) { + + /* compute all the coefficients, filling invalid positions with P*/ + size_t lastFilledPos = 0; + for (size_t i = 0 ; i < sizeA ; i++) { + for (size_t j = 0 ; j < sizeB ; j++) { + uint32_t prod = A[i] + B[j]; + prod = ( (prod >= P) ? prod - P : prod); + if ((A[i] != INVALID_POS_VALUE) && + (B[j] != INVALID_POS_VALUE)) { + Res[lastFilledPos] = prod; + } else { + Res[lastFilledPos] = INVALID_POS_VALUE; + } + lastFilledPos++; + } + } + while (lastFilledPos < sizeR) { + Res[lastFilledPos] = INVALID_POS_VALUE; + lastFilledPos++; + } + PQCLEAN_LEDAKEMLT12_LEAKTIME_quicksort_sparse(Res); + /* eliminate duplicates */ + POSITION_T lastReadPos = Res[0]; + int duplicateCount; + size_t write_idx = 0; + size_t read_idx = 0; + while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { + lastReadPos = Res[read_idx]; + read_idx++; + duplicateCount = 1; + while ( (Res[read_idx] == lastReadPos) && (Res[read_idx] != INVALID_POS_VALUE)) { + read_idx++; + duplicateCount++; + } + if (duplicateCount % 2) { + Res[write_idx] = lastReadPos; + write_idx++; + } + } + /* fill remaining cells with INVALID_POS_VALUE */ + for (; write_idx < sizeR; write_idx++) { + Res[write_idx] = INVALID_POS_VALUE; + } +} + +/* the implementation is safe even in case A or B alias with the result + * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse( + int sizeR, POSITION_T Res[], + int sizeA, const POSITION_T A[], + int sizeB, const POSITION_T B[]) { + + POSITION_T tmpRes[DV * M]; + int idxA = 0, idxB = 0, idxR = 0; + while ( idxA < sizeA && + idxB < sizeB && + A[idxA] != INVALID_POS_VALUE && + B[idxB] != INVALID_POS_VALUE ) { + + if (A[idxA] == B[idxB]) { + idxA++; + idxB++; + } else { + if (A[idxA] < B[idxB]) { + tmpRes[idxR] = A[idxA]; + idxA++; + } else { + tmpRes[idxR] = B[idxB]; + idxB++; + } + idxR++; + } + } + + while (idxA < sizeA && A[idxA] != INVALID_POS_VALUE) { + tmpRes[idxR] = A[idxA]; + idxA++; + idxR++; + } + + while (idxB < sizeB && B[idxB] != INVALID_POS_VALUE) { + tmpRes[idxR] = B[idxB]; + idxB++; + idxR++; + } + + while (idxR < sizeR) { + tmpRes[idxR] = INVALID_POS_VALUE; + idxR++; + } + memcpy(Res, tmpRes, sizeof(POSITION_T)*sizeR); + +} + +/* Return a uniform random value in the range 0..n-1 inclusive, + * applying a rejection sampling strategy and exploiting as a random source + * the NIST seedexpander seeded with the proper key. + * Assumes that the maximum value for the range n is 2^32-1 + */ +static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct *seed_expander_ctx) { + unsigned long required_rnd_bytes = (logn + 7) / 8; + unsigned char rnd_char_buffer[4]; + uint32_t rnd_value; + uint32_t mask = ( (uint32_t)1 << logn) - 1; + + do { + PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(seed_expander_ctx, rnd_char_buffer, required_rnd_bytes); + /* obtain an endianness independent representation of the generated random + bytes into an unsigned integer */ + rnd_value = ((uint32_t)rnd_char_buffer[3] << 24) + + ((uint32_t)rnd_char_buffer[2] << 16) + + ((uint32_t)rnd_char_buffer[1] << 8) + + ((uint32_t)rnd_char_buffer[0] << 0) ; + rnd_value = mask & rnd_value; + } while (rnd_value >= n); + + return rnd_value; +} + +/* Obtains fresh randomness and seed-expands it until all the required positions + * for the '1's in the circulant block are obtained */ +void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, + int countOnes, + AES_XOF_struct *seed_expander_ctx) { + + int duplicated, placedOnes = 0; + uint32_t p; + + while (placedOnes < countOnes) { + p = rand_range(NUM_BITS_GF2X_ELEMENT, + P_BITS, + seed_expander_ctx); + duplicated = 0; + for (int j = 0; j < placedOnes; j++) { + if (pos_ones[j] == p) { + duplicated = 1; + } + } + if (duplicated == 0) { + pos_ones[placedOnes] = p; + placedOnes++; + } + } +} + +/* Returns random weight-t circulant block */ +void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_blocks_sequence( + DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], + AES_XOF_struct *seed_expander_ctx) { + + int rndPos[NUM_ERRORS_T], duplicated, counter = 0; + int p, polyIndex, exponent; + + memset(sequence, 0x00, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + + while (counter < NUM_ERRORS_T) { + p = rand_range(N0 * NUM_BITS_GF2X_ELEMENT, P_BITS, + seed_expander_ctx); + duplicated = 0; + for (int j = 0; j < counter; j++) { + if (rndPos[j] == p) { + duplicated = 1; + } + } + if (duplicated == 0) { + rndPos[counter] = p; + counter++; + } + } + for (int j = 0; j < counter; j++) { + polyIndex = rndPos[j] / P; + exponent = rndPos[j] % P; + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff( sequence + NUM_DIGITS_GF2X_ELEMENT * polyIndex, exponent, + ( (DIGIT) 1)); + } + +} + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly) { + size_t i, j; + for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + for (j = 0; j < DIGIT_SIZE_B; j++) { + bytes[i * DIGIT_SIZE_B + j] = (uint8_t) (poly[i] >> 8 * j); + } + } +} + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes) { + size_t i, j; + for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + poly[i] = (DIGIT) 0; + for (j = 0; j < DIGIT_SIZE_B; j++) { + poly[i] |= (DIGIT) poly_bytes[i * DIGIT_SIZE_B + j] << 8 * j; + } + } +} diff --git a/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.h b/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.h new file mode 100644 index 00000000..8fa0d40a --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.h @@ -0,0 +1,38 @@ +#ifndef GF2X_ARITH_MOD_XPLUSONE_H +#define GF2X_ARITH_MOD_XPLUSONE_H + +#include "qc_ldpc_parameters.h" + +#include "gf2x_arith.h" +#include "rng.h" + +#define NUM_BITS_GF2X_ELEMENT (P) // 52147 +#define NUM_DIGITS_GF2X_ELEMENT ((P+DIGIT_SIZE_b-1)/DIGIT_SIZE_b) +#define MSb_POSITION_IN_MSB_DIGIT_OF_ELEMENT ((P % DIGIT_SIZE_b) ? (P % DIGIT_SIZE_b)-1 : DIGIT_SIZE_b-1) +#define NUM_BITS_GF2X_MODULUS (P+1) +#define NUM_DIGITS_GF2X_MODULUS ((P+1+DIGIT_SIZE_b-1)/DIGIT_SIZE_b) +#define MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS (P-DIGIT_SIZE_b*(NUM_DIGITS_GF2X_MODULUS-1)) +#define INVALID_POS_VALUE (P) +#define P_BITS (16) // log_2(p) = 15.6703 + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); +DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent); +int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(DIGIT *poly); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_quicksort_sparse(POSITION_T Res[]); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]); +int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); + + +#endif diff --git a/crypto_kem/ledakemlt12/leaktime/kem.c b/crypto_kem/ledakemlt12/leaktime/kem.c new file mode 100644 index 00000000..5a06bf0b --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/kem.c @@ -0,0 +1,92 @@ +#include "api.h" +#include "niederreiter.h" +#include "randombytes.h" +#include "rng.h" + +#include + +static void pack_pk(uint8_t *pk_bytes, publicKeyNiederreiter_t *pk) { + size_t i; + for (i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_tobytes(pk_bytes + i * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B, + pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); + } +} + +static void unpack_pk(publicKeyNiederreiter_t *pk, const uint8_t *pk_bytes) { + size_t i; + for (i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_frombytes(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, + pk_bytes + i * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + } +} + +static void pack_ct(uint8_t *sk_bytes, DIGIT *ct) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_tobytes(sk_bytes, ct); +} + +static void unpack_ct(DIGIT *ct, const uint8_t *ct_bytes) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_frombytes(ct, ct_bytes); +} + +static void pack_error(uint8_t *error_bytes, DIGIT *error_digits) { + size_t i; + for (i = 0; i < N0; i++) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_tobytes(error_bytes + i * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B, + error_digits + i * NUM_DIGITS_GF2X_ELEMENT); + } +} + +/* Generates a keypair - pk is the public key and sk is the secret key. */ +int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_keypair(unsigned char *pk, unsigned char *sk) { + AES_XOF_struct niederreiter_keys_expander; + publicKeyNiederreiter_t pk_nie; + + randombytes(((privateKeyNiederreiter_t *)sk)->prng_seed, TRNG_BYTE_LENGTH); + PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(&niederreiter_keys_expander, ((privateKeyNiederreiter_t *)sk)->prng_seed); + PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_keygen(&pk_nie, (privateKeyNiederreiter_t *) sk, &niederreiter_keys_expander); + + pack_pk(pk, &pk_nie); + + return 0; +} + +/* Encrypt - pk is the public key, ct is a key encapsulation message + (ciphertext), ss is the shared secret.*/ +int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk) { + AES_XOF_struct niederreiter_encap_key_expander; + unsigned char encapsulated_key_seed[TRNG_BYTE_LENGTH]; + DIGIT error_vector[N0 * NUM_DIGITS_GF2X_ELEMENT]; + uint8_t error_bytes[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; + DIGIT syndrome[NUM_DIGITS_GF2X_ELEMENT]; + publicKeyNiederreiter_t pk_nie; + + randombytes(encapsulated_key_seed, TRNG_BYTE_LENGTH); + unpack_pk(&pk_nie, pk); + + PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(&niederreiter_encap_key_expander, encapsulated_key_seed); + PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_blocks_sequence(error_vector, &niederreiter_encap_key_expander); + pack_error(error_bytes, error_vector); + HASH_FUNCTION(ss, error_bytes, (N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B)); + PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_encrypt(syndrome, &pk_nie, error_vector); + + pack_ct(ct, syndrome); + + return 0; +} + + +/* Decrypt - ct is a key encapsulation message (ciphertext), sk is the private + key, ss is the shared secret */ +int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk) { + DIGIT decoded_error_vector[N0 * NUM_DIGITS_GF2X_ELEMENT]; + uint8_t decoded_error_bytes[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; + DIGIT syndrome[NUM_DIGITS_GF2X_ELEMENT]; + + unpack_ct(syndrome, ct); + PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(decoded_error_vector, (privateKeyNiederreiter_t *)sk, syndrome); + pack_error(decoded_error_bytes, decoded_error_vector); + HASH_FUNCTION(ss, decoded_error_bytes, (N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B)); + + return 0; +} diff --git a/crypto_kem/ledakemlt12/leaktime/niederreiter.c b/crypto_kem/ledakemlt12/leaktime/niederreiter.c new file mode 100644 index 00000000..273f2c41 --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/niederreiter.c @@ -0,0 +1,192 @@ +#include "H_Q_matrices_generation.h" +#include "bf_decoding.h" +#include "dfr_test.h" +#include "gf2x_arith_mod_xPplusOne.h" +#include "niederreiter.h" +#include "qc_ldpc_parameters.h" +#include "rng.h" + +#include + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *pk, privateKeyNiederreiter_t *sk, AES_XOF_struct *keys_expander) { + + POSITION_T HPosOnes[N0][DV]; // sequence of N0 circ block matrices (p x p): Hi + POSITION_T HtrPosOnes[N0][DV]; // Sparse tranposed circulant H + POSITION_T QPosOnes[N0][M]; // Sparse Q, Each row contains the position of the ones of all the blocks of a row of Q as exponent+P*block_position + POSITION_T LPosOnes[N0][DV * M]; + POSITION_T auxPosOnes[DV * M]; + unsigned char processedQOnes[N0]; + DIGIT Ln0dense[NUM_DIGITS_GF2X_ELEMENT]; + DIGIT Ln0Inv[NUM_DIGITS_GF2X_ELEMENT]; + int is_L_full = 0; + uint8_t threshold = (DV * M) / 2 + 1; // threshold for round 2 + sk->rejections = (int8_t) 0; + + do { + PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes_HtrPosOnes(HPosOnes, HtrPosOnes, keys_expander); + PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQsparse(QPosOnes, keys_expander); + for (int i = 0; i < N0; i++) { + for (int j = 0; j < DV * M; j++) { + LPosOnes[i][j] = INVALID_POS_VALUE; + } + } + + memset(processedQOnes, 0x00, sizeof(processedQOnes)); + for (int colQ = 0; colQ < N0; colQ++) { + for (int i = 0; i < N0; i++) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, + DV, HPosOnes[i], + qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(DV * M, LPosOnes[colQ], + DV * M, LPosOnes[colQ], + DV * M, auxPosOnes); + processedQOnes[i] += qBlockWeights[i][colQ]; + } + } + is_L_full = 1; + for (int i = 0; i < N0; i++) { + is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); + } + sk->rejections = sk->rejections + 1; + if (is_L_full) { + threshold = PQCLEAN_LEDAKEMLT12_LEAKTIME_DFR_test(LPosOnes); + } + } while (!is_L_full || threshold == DFR_TEST_FAIL); + sk->rejections = sk->rejections - 1; + sk->threshold = threshold; + + memset(Ln0dense, 0x00, sizeof(Ln0dense)); + for (int j = 0; j < DV * M; j++) { + if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); + } + } + + memset(Ln0Inv, 0x00, sizeof(Ln0Inv)); + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); + for (int i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, + Ln0Inv, + LPosOnes[i], + DV * M); + } + + for (int i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); + } +} + + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_encrypt(DIGIT *syndrome, const publicKeyNiederreiter_t *pk, const DIGIT *err) { + int i; + DIGIT saux[NUM_DIGITS_GF2X_ELEMENT]; + + memset(syndrome, 0x00, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + for (i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul(saux, + pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, + err + i * NUM_DIGITS_GF2X_ELEMENT); + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add(syndrome, syndrome, saux); + } + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add(syndrome, syndrome, err + (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT); +} + + +int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateKeyNiederreiter_t *sk, const DIGIT *syndrome) { + AES_XOF_struct niederreiter_decrypt_expander; + POSITION_T HPosOnes[N0][DV]; + POSITION_T HtrPosOnes[N0][DV]; + POSITION_T QPosOnes[N0][M]; + POSITION_T QtrPosOnes[N0][M]; + POSITION_T auxPosOnes[DV * M]; + POSITION_T LPosOnes[N0][DV * M]; + POSITION_T auxSparse[DV * M]; + POSITION_T Ln0trSparse[DV * M]; + unsigned char processedQOnes[N0]; + unsigned transposed_ones_idx[N0]; + DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; + DIGIT mockup_error_vector[N0 * NUM_DIGITS_GF2X_ELEMENT]; + int rejections = sk->rejections; + int currQoneIdx, endQblockIdx; + int decryptOk, err_weight; + + PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); + + do { + PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes_HtrPosOnes(HPosOnes, HtrPosOnes, &niederreiter_decrypt_expander); + PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQsparse(QPosOnes, &niederreiter_decrypt_expander); + for (int i = 0; i < N0; i++) { + for (int j = 0; j < DV * M; j++) { + LPosOnes[i][j] = INVALID_POS_VALUE; + } + } + + memset(processedQOnes, 0x00, sizeof(processedQOnes)); + for (int colQ = 0; colQ < N0; colQ++) { + for (int i = 0; i < N0; i++) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, + DV, HPosOnes[i], + qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(DV * M, LPosOnes[colQ], + DV * M, LPosOnes[colQ], + DV * M, auxPosOnes); + processedQOnes[i] += qBlockWeights[i][colQ]; + } + } + rejections--; + } while (rejections >= 0); + + memset(transposed_ones_idx, 0x00, sizeof(transposed_ones_idx)); + for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { + currQoneIdx = 0; // position in the column of QtrPosOnes[][...] + endQblockIdx = 0; + for (int blockIdx = 0; blockIdx < N0; blockIdx++) { + endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; + for (; currQoneIdx < endQblockIdx; currQoneIdx++) { + QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P - + QPosOnes[source_row_idx][currQoneIdx]) % P; + transposed_ones_idx[blockIdx]++; + } + } + } + + for (int i = 0; i < DV * M; i++) { + Ln0trSparse[i] = INVALID_POS_VALUE; + auxSparse[i] = INVALID_POS_VALUE; + } + + for (int i = 0; i < N0; i++) { + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, + DV, HPosOnes[i], + qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1]]); + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, + DV * M, Ln0trSparse, + DV * M, auxSparse); + } + + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(DV * M, Ln0trSparse); + PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(privateSyndrome, syndrome, Ln0trSparse, DV * M); + + /* prepare mockup error vector in case a decoding failure occurs */ + memset(mockup_error_vector, 0x00, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + memcpy(mockup_error_vector, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(&niederreiter_decrypt_expander, + ((unsigned char *) mockup_error_vector) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B), + TRNG_BYTE_LENGTH); + + memset(err, 0x00, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + decryptOk = PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(err, (const POSITION_T (*)[DV]) HtrPosOnes, + (const POSITION_T (*)[M]) QtrPosOnes, privateSyndrome, sk->threshold); + + err_weight = 0; + for (int i = 0 ; i < N0; i++) { + err_weight += PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(err + (NUM_DIGITS_GF2X_ELEMENT * i)); + } + decryptOk = decryptOk && (err_weight == NUM_ERRORS_T); + + if (!decryptOk) { // TODO: not constant time, replace with cmov? + memcpy(err, mockup_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + } + + return decryptOk; +} diff --git a/crypto_kem/ledakemlt12/leaktime/niederreiter.h b/crypto_kem/ledakemlt12/leaktime/niederreiter.h new file mode 100644 index 00000000..17da4c29 --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/niederreiter.h @@ -0,0 +1,29 @@ +#ifndef NIEDERREITER_H +#define NIEDERREITER_H + +#include "gf2x_arith_mod_xPplusOne.h" +#include "qc_ldpc_parameters.h" +#include "rng.h" + +typedef struct { + /* raw entropy extracted from TRNG, will be deterministically expanded into + * H and Q during decryption */ + unsigned char prng_seed[TRNG_BYTE_LENGTH]; + int8_t rejections; + uint8_t threshold; // for round 2 +} privateKeyNiederreiter_t; + +typedef struct { + DIGIT Mtr[(N0 - 1)*NUM_DIGITS_GF2X_ELEMENT]; + // Dense representation of the matrix M=Ln0*L, + // An array including a sequence of (N0-1) gf2x elements; + // each gf2x element is stored as a binary polynomial(mod x^P+1) + // with P coefficients. +} publicKeyNiederreiter_t; + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *pk, privateKeyNiederreiter_t *sk, AES_XOF_struct *keys_expander); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_encrypt(DIGIT syndrome[], const publicKeyNiederreiter_t *pk, const DIGIT *err); +int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateKeyNiederreiter_t *sk, const DIGIT *syndrome); + + +#endif diff --git a/crypto_kem/ledakemlt12/leaktime/qc_ldpc_parameters.h b/crypto_kem/ledakemlt12/leaktime/qc_ldpc_parameters.h new file mode 100644 index 00000000..01c9c204 --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/qc_ldpc_parameters.h @@ -0,0 +1,27 @@ +#ifndef QC_LDPC_PARAMETERS_H +#define QC_LDPC_PARAMETERS_H + +#include "fips202.h" + +#define TRNG_BYTE_LENGTH (24) +#define HASH_BYTE_LENGTH (32) +#define HASH_FUNCTION sha3_256 + +#define N0 (2) +#define P (52147) // modulus(x) = x^P-1 +#define DV (9) // odd number +#define M (9) +#define M0 (5) +#define M1 (4) +#define NUM_ERRORS_T (136) + +// Derived parameters, they are useful for QC-LDPC algorithms +#define HASH_BIT_LENGTH (HASH_BYTE_LENGTH << 3) +#define K ((N0-1)*P) +#define N (N0*P) +#define DC (N0*DV) + +#define Q_BLOCK_WEIGHTS {{M0,M1},{M1,M0}} +static const unsigned char qBlockWeights[N0][N0] = Q_BLOCK_WEIGHTS; + +#endif diff --git a/crypto_kem/ledakemlt12/leaktime/rng.c b/crypto_kem/ledakemlt12/leaktime/rng.c new file mode 100644 index 00000000..6d7604e6 --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/rng.c @@ -0,0 +1,108 @@ +#include "rng.h" + +#include // void *memset(void *s, int c, size_t n); + +#include "aes.h" +#include "qc_ldpc_parameters.h" + +/* + seedexpander_init() + ctx - stores the current state of an instance of the seed expander + seed - a 32 byte random value + diversifier - an 8 byte diversifier + maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier + */ +static void seedexpander_init(AES_XOF_struct *ctx, + unsigned char *seed, + unsigned char *diversifier, + size_t maxlen) { + + ctx->length_remaining = maxlen; + + memset(ctx->key, 0, 32); + int max_accessible_seed_len = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; + memcpy(ctx->key, seed, max_accessible_seed_len); + + memcpy(ctx->ctr, diversifier, 8); + ctx->ctr[11] = maxlen % 256; + maxlen >>= 8; + ctx->ctr[10] = maxlen % 256; + maxlen >>= 8; + ctx->ctr[9] = maxlen % 256; + maxlen >>= 8; + ctx->ctr[8] = maxlen % 256; + memset(ctx->ctr + 12, 0x00, 4); + + ctx->buffer_pos = 16; + memset(ctx->buffer, 0x00, 16); +} + +void PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, + const unsigned char *trng_entropy + /* TRNG_BYTE_LENGTH wide buffer */) { + + /*the NIST seedexpander will however access 32B from this buffer */ + unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; + unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 }; + unsigned char diversifier[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; + + memcpy(prng_buffer, + trng_entropy, + TRNG_BYTE_LENGTH < prng_buffer_size ? TRNG_BYTE_LENGTH : prng_buffer_size); + + /* the required seed expansion will be quite small, set the max number of + * bytes conservatively to 10 MiB*/ + seedexpander_init(ctx, prng_buffer, diversifier, RNG_MAXLEN); +} + +/* + seedexpander() + ctx - stores the current state of an instance of the seed expander + x - returns the XOF data + xlen - number of bytes to return + */ +int PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) { + size_t offset; + aes256ctx ctx256; + + if ( x == NULL ) { + return RNG_BAD_OUTBUF; + } + if ( xlen >= ctx->length_remaining ) { + return RNG_BAD_REQ_LEN; + } + + aes256_keyexp(&ctx256, ctx->key); + ctx->length_remaining -= xlen; + + offset = 0; + while ( xlen > 0 ) { + if ( xlen <= (16 - ctx->buffer_pos) ) { // buffer has what we need + memcpy(x + offset, ctx->buffer + ctx->buffer_pos, xlen); + ctx->buffer_pos += xlen; + + return RNG_SUCCESS; + } + + // take what's in the buffer + memcpy(x + offset, ctx->buffer + ctx->buffer_pos, 16 - ctx->buffer_pos); + xlen -= 16 - ctx->buffer_pos; + offset += 16 - ctx->buffer_pos; + + aes256_ecb(ctx->buffer, ctx->ctr, 16 / AES_BLOCKBYTES, &ctx256); + ctx->buffer_pos = 0; + + //increment the counter + for (int i = 15; i >= 12; i--) { + if ( ctx->ctr[i] == 0xff ) { + ctx->ctr[i] = 0x00; + } else { + ctx->ctr[i]++; + break; + } + } + + } + + return RNG_SUCCESS; +} diff --git a/crypto_kem/ledakemlt12/leaktime/rng.h b/crypto_kem/ledakemlt12/leaktime/rng.h new file mode 100644 index 00000000..fc35f19f --- /dev/null +++ b/crypto_kem/ledakemlt12/leaktime/rng.h @@ -0,0 +1,24 @@ +#ifndef RNG_H +#define RNG_H + +#include +#include + +#define RNG_SUCCESS ( 0) +#define RNG_BAD_MAXLEN (-1) +#define RNG_BAD_OUTBUF (-2) +#define RNG_BAD_REQ_LEN (-3) +#define RNG_MAXLEN (10 * 1024 * 1024) + +typedef struct { + unsigned char buffer[16]; + size_t buffer_pos; + size_t length_remaining; + unsigned char key[32]; + unsigned char ctr[16]; +} AES_XOF_struct; + +int PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen); +void PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, const unsigned char *trng_entropy); + +#endif diff --git a/crypto_kem/ledakemlt32/META.yml b/crypto_kem/ledakemlt32/META.yml new file mode 100644 index 00000000..c6c040a5 --- /dev/null +++ b/crypto_kem/ledakemlt32/META.yml @@ -0,0 +1,18 @@ +name: LEDAcryptKEMLT32 +type: kem +claimed-nist-level: 3 +claimed-security: IND-CCA2 +length-public-key: 12032 +length-secret-key: 34 +length-ciphertext: 12032 +length-shared-secret: 48 +nistkat-sha256: 455dc69ee95196fe0526c3289fe46792acd55ac380b3c66be48eb3e3e10ad4e6 +principal-submitter: Marco Baldi +auxiliary-submitters: + - Alessandro Barenghi + - Franco Chiaraluce + - Gerardo Pelosi + - Paolo Santini +implementations: + - name: leaktime + version: 2.? diff --git a/crypto_kem/ledakemlt32/leaktime/H_Q_matrices_generation.c b/crypto_kem/ledakemlt32/leaktime/H_Q_matrices_generation.c new file mode 100644 index 00000000..37a455b1 --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/H_Q_matrices_generation.c @@ -0,0 +1,32 @@ +#include "H_Q_matrices_generation.h" +#include "gf2x_arith_mod_xPplusOne.h" + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes_HtrPosOnes( + POSITION_T HPosOnes[N0][DV], + POSITION_T HtrPosOnes[N0][DV], + AES_XOF_struct *keys_expander) { + for (int i = 0; i < N0; i++) { + /* Generate a random block of Htr */ + PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&HtrPosOnes[i][0], DV, keys_expander); + } + for (int i = 0; i < N0; i++) { + /* Obtain directly the sparse representation of the block of H */ + for (int k = 0; k < DV; k++) { + HPosOnes[i][k] = (P - HtrPosOnes[i][k]) % P; /* transposes indexes */ + } + } +} + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQsparse( + POSITION_T pos_ones[N0][M], + AES_XOF_struct *keys_expander) { + for (int i = 0; i < N0; i++) { + int placed_ones = 0; + for (int j = 0; j < N0; j++) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&pos_ones[i][placed_ones], + qBlockWeights[i][j], + keys_expander); + placed_ones += qBlockWeights[i][j]; + } + } +} diff --git a/crypto_kem/ledakemlt32/leaktime/H_Q_matrices_generation.h b/crypto_kem/ledakemlt32/leaktime/H_Q_matrices_generation.h new file mode 100644 index 00000000..23bd44f0 --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/H_Q_matrices_generation.h @@ -0,0 +1,11 @@ +#ifndef H_Q_MATRICES_GENERATION_H +#define H_Q_MATRICES_GENERATION_H + +#include "gf2x_arith.h" +#include "qc_ldpc_parameters.h" +#include "rng.h" + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes_HtrPosOnes(POSITION_T HPosOnes[N0][DV], POSITION_T HtrPosOnes[N0][DV], AES_XOF_struct *niederreiter_keys_expander); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQsparse(POSITION_T pos_ones[N0][M], AES_XOF_struct *niederreiter_keys_expander); + +#endif diff --git a/crypto_kem/ledakemlt32/leaktime/LICENSE b/crypto_kem/ledakemlt32/leaktime/LICENSE new file mode 100644 index 00000000..c1761078 --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/LICENSE @@ -0,0 +1,31 @@ +/** + * + * LEDAcryptKEM + * + * @version 2.0 (March 2019) + * + * Adapted code from reference ISO-C11 Implementation of the LEDAcrypt KEM-LT cipher. + * + * In alphabetical order: + * + * @author Marco Baldi + * @author Alessandro Barenghi + * @author Franco Chiaraluce + * @author Gerardo Pelosi + * @author Paolo Santini + * + * This code is hereby placed in the public domain. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS + * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE + * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, + * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + **/ diff --git a/crypto_kem/ledakemlt32/leaktime/Makefile b/crypto_kem/ledakemlt32/leaktime/Makefile new file mode 100644 index 00000000..d8d4e9cb --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/Makefile @@ -0,0 +1,24 @@ +# This Makefile can be used with GNU Make or BSD Make + +LIB=libledakemlt32_leaktime.a +HEADERS=api.h bf_decoding.h dfr_test.h gf2x_arith_mod_xPplusOne.h \ + gf2x_arith.h H_Q_matrices_generation.h \ + niederreiter.h qc_ldpc_parameters.h rng.h + +OBJECTS=bf_decoding.o dfr_test.o gf2x_arith_mod_xPplusOne.o \ + gf2x_arith.o H_Q_matrices_generation.o kem.o niederreiter.o rng.o + +CFLAGS=-O3 -Wall -Werror -Wextra -Wvla -Wpedantic -Wmissing-prototypes -std=c99 \ + -I../../../common $(EXTRAFLAGS) + +all: $(LIB) + +%.o: %.c $(HEADERS) + $(CC) $(CFLAGS) -c -o $@ $< + +$(LIB): $(OBJECTS) + $(AR) -r $@ $(OBJECTS) + +clean: + $(RM) $(OBJECTS) + $(RM) $(LIB) diff --git a/crypto_kem/ledakemlt32/leaktime/Makefile.Microsoft_nmake b/crypto_kem/ledakemlt32/leaktime/Makefile.Microsoft_nmake new file mode 100644 index 00000000..f895e6dc --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/Makefile.Microsoft_nmake @@ -0,0 +1,19 @@ +# This Makefile can be used with Microsoft Visual Studio's nmake using the command: +# nmake /f Makefile.Microsoft_nmake + +LIBRARY=libledakemlt32_leaktime.lib +OBJECTS=bf_decoding.obj dfr_test.obj gf2x_arith_mod_xPplusOne.obj gf2x_arith.obj H_Q_matrices_generation.obj kem.obj niederreiter.obj rng.obj + +CFLAGS=/nologo /I ..\..\..\common /W4 /WX + +all: $(LIBRARY) + +# Make sure objects are recompiled if headers change. +$(OBJECTS): *.h + +$(LIBRARY): $(OBJECTS) + LIB.EXE /NOLOGO /WX /OUT:$@ $** + +clean: + -DEL $(OBJECTS) + -DEL $(LIBRARY) diff --git a/crypto_kem/ledakemlt32/leaktime/api.h b/crypto_kem/ledakemlt32/leaktime/api.h new file mode 100644 index 00000000..0a048aa3 --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/api.h @@ -0,0 +1,18 @@ +#ifndef PQCLEAN_LEDAKEMLT32_LEAKTIME_API_H +#define PQCLEAN_LEDAKEMLT32_LEAKTIME_API_H + +#include + +#define PQCLEAN_LEDAKEMLT32_LEAKTIME_CRYPTO_SECRETKEYBYTES 34 +#define PQCLEAN_LEDAKEMLT32_LEAKTIME_CRYPTO_PUBLICKEYBYTES 12032 +#define PQCLEAN_LEDAKEMLT32_LEAKTIME_CRYPTO_CIPHERTEXTBYTES 12032 +#define PQCLEAN_LEDAKEMLT32_LEAKTIME_CRYPTO_BYTES 48 + +#define PQCLEAN_LEDAKEMLT32_LEAKTIME_CRYPTO_ALGNAME "LEDAKEMLT32" + +int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_keypair(uint8_t *pk, uint8_t *sk); +int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk); +int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk); + + +#endif diff --git a/crypto_kem/ledakemlt32/leaktime/bf_decoding.c b/crypto_kem/ledakemlt32/leaktime/bf_decoding.c new file mode 100644 index 00000000..07957b6c --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/bf_decoding.c @@ -0,0 +1,76 @@ +#include "bf_decoding.h" +#include "gf2x_arith_mod_xPplusOne.h" + +#include + +int PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(DIGIT err[], + const POSITION_T HtrPosOnes[N0][DV], + const POSITION_T QtrPosOnes[N0][M], + DIGIT privateSyndrome[], + uint8_t threshold) { + + uint8_t unsatParityChecks[N0 * P]; + POSITION_T currQBlkPos[M], currQBitPos[M]; + DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; + int check; + int iteration = 0; + unsigned int corrt_syndrome_based; + + do { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); + memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); + for (int i = 0; i < N0; i++) { + for (int valueIdx = 0; valueIdx < P; valueIdx++) { + for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { + POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx); + if (PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { + unsatParityChecks[i * P + valueIdx]++; + } + } + } + } + + /* iteration based threshold determination*/ + corrt_syndrome_based = iteration ? (unsigned int) threshold : B0; + + //Computation of correlation with a full Q matrix + for (int i = 0; i < N0; i++) { + for (int j = 0; j < P; j++) { + int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] + int endQblockIdx = 0; + unsigned int correlation = 0; + + for (int blockIdx = 0; blockIdx < N0; blockIdx++) { + endQblockIdx += qBlockWeights[blockIdx][i]; + int currblockoffset = blockIdx * P; + for (; currQoneIdx < endQblockIdx; currQoneIdx++) { + POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j; + tmp = tmp >= P ? tmp - P : tmp; + currQBitPos[currQoneIdx] = tmp; + currQBlkPos[currQoneIdx] = blockIdx; + correlation += unsatParityChecks[tmp + currblockoffset]; + } + } + /* Correlation based flipping */ + if (correlation >= corrt_syndrome_based) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); + for (int v = 0; v < M; v++) { + POSITION_T syndromePosToFlip; + for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { + syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] ); + syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); + } + } // end for v + } // end if + } // end for j + } // end for i + + iteration = iteration + 1; + check = 0; + while (check < NUM_DIGITS_GF2X_ELEMENT && privateSyndrome[check++] == 0) {}; + + } while (iteration < ITERATIONS_MAX && check < NUM_DIGITS_GF2X_ELEMENT); + + return (check == NUM_DIGITS_GF2X_ELEMENT); +} diff --git a/crypto_kem/ledakemlt32/leaktime/bf_decoding.h b/crypto_kem/ledakemlt32/leaktime/bf_decoding.h new file mode 100644 index 00000000..a55b0300 --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/bf_decoding.h @@ -0,0 +1,18 @@ +#ifndef BF_DECODING_H +#define BF_DECODING_H + +#include "gf2x_arith.h" +#include "qc_ldpc_parameters.h" + +/* Definitions for DFR level 2^-SL with SL=128 */ +#define ITERATIONS_MAX (2) +#define B0 (64) +#define T_BAR (5) + +int PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(DIGIT err[], + const POSITION_T HtrPosOnes[N0][DV], + const POSITION_T QtrPosOnes[N0][M], + DIGIT privateSyndrome[], + uint8_t threshold); + +#endif diff --git a/crypto_kem/ledakemlt32/leaktime/dfr_test.c b/crypto_kem/ledakemlt32/leaktime/dfr_test.c new file mode 100644 index 00000000..73a52f6f --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/dfr_test.c @@ -0,0 +1,112 @@ +#include "bf_decoding.h" +#include "dfr_test.h" +#include "gf2x_arith_mod_xPplusOne.h" +#include "qc_ldpc_parameters.h" + +#include + +/* Tests if the current code attains the desired DFR. If that is the case, + * computes the threshold for the second iteration of the decoder and returns this values + * (max DV * M), on failure it returns 255 >> DV * M */ + +uint8_t PQCLEAN_LEDAKEMLT32_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M]) { + + POSITION_T LSparse_loc[N0][DV * M]; + POSITION_T rotated_column[DV * M]; + /* Gamma matrix: an N0 x N0 block circulant matrix with block size p + * gamma[a][b][c] stores the intersection of the first column of the a-th + * block of L with the c-th column of the b-th block of L. + * Gamma computation can be accelerated employing symmetry and QC properties */ + unsigned int gamma[N0][N0][P] = {{{0}}}; + unsigned int gammaHist[N0][DV * M + 1] = {{0}}; + unsigned int maxMut[N0], maxMutMinusOne[N0]; + unsigned int firstidx, secondidx, intersectionval; + unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; + unsigned int toAdd, histIdx; + + /*transpose blocks of L, we need its columns */ + for (int i = 0; i < N0; i++) { + for (int j = 0; j < DV * M; j++) { + if (LSparse[i][j] != 0) { + LSparse_loc[i][j] = (P - LSparse[i][j]); + } + } + PQCLEAN_LEDAKEMLT32_LEAKTIME_quicksort_sparse(LSparse_loc[i]); + } + + for (int i = 0; i < N0; i++ ) { + for (int j = 0; j < N0; j++ ) { + for (int k = 0; k < P; k++) { + /* compute the rotated sparse column needed */ + for (int idxToRotate = 0; idxToRotate < (DV * M); idxToRotate++) { + rotated_column[idxToRotate] = (LSparse_loc[j][idxToRotate] + k) % P; + } + PQCLEAN_LEDAKEMLT32_LEAKTIME_quicksort_sparse(rotated_column); + /* compute the intersection amount */ + firstidx = 0, secondidx = 0; + intersectionval = 0; + while ( (firstidx < DV * M) && (secondidx < DV * M) ) { + if ( LSparse_loc[i][firstidx] == rotated_column[secondidx] ) { + intersectionval++; + firstidx++; + secondidx++; + } else if ( LSparse_loc[i][firstidx] > rotated_column[secondidx] ) { + secondidx++; + } else { /*if ( LSparse_loc[i][firstidx] < rotated_column[secondidx] ) */ + firstidx++; + } + } + gamma[i][j][k] = intersectionval; + + } + } + } + for (int i = 0; i < N0; i++ ) { + for (int j = 0; j < N0; j++ ) { + gamma[i][j][0] = 0; + } + } + /* build histogram of values in gamma */ + for (int i = 0; i < N0; i++ ) { + for (int j = 0; j < N0; j++ ) { + for (int k = 0; k < P; k++) { + gammaHist[i][gamma[i][j][k]]++; + } + } + } + + + for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { + toAdd = T_BAR - 1; + maxMutMinusOne[gammaBlockRowIdx] = 0; + histIdx = DV * M; + while ( (histIdx > 0) && (toAdd > 0)) { + if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { + maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; + toAdd = 0; + } else { + maxMutMinusOne[gammaBlockRowIdx] += histIdx * gammaHist[gammaBlockRowIdx][histIdx]; + toAdd -= gammaHist[gammaBlockRowIdx][histIdx]; + histIdx--; + } + } + maxMut[gammaBlockRowIdx] = histIdx + maxMutMinusOne[gammaBlockRowIdx]; + } + + + /*seek max values across all gamma blocks */ + allBlockMaxSumst = maxMut[0]; + allBlockMaxSumstMinusOne = maxMutMinusOne[0]; + for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { + allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? + maxMut[gammaBlockRowIdx] : + allBlockMaxSumst; + allBlockMaxSumstMinusOne = allBlockMaxSumstMinusOne < maxMutMinusOne[gammaBlockRowIdx] ? + maxMutMinusOne[gammaBlockRowIdx] : + allBlockMaxSumstMinusOne; + } + if (DV * M > (allBlockMaxSumstMinusOne + allBlockMaxSumst)) { + return (uint8_t) allBlockMaxSumst + 1; + } + return DFR_TEST_FAIL; +} diff --git a/crypto_kem/ledakemlt32/leaktime/dfr_test.h b/crypto_kem/ledakemlt32/leaktime/dfr_test.h new file mode 100644 index 00000000..d1484ac9 --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/dfr_test.h @@ -0,0 +1,8 @@ +#ifndef DFR_TEST_H +#define DFR_TEST_H + +#define DFR_TEST_FAIL (255) + +uint8_t PQCLEAN_LEDAKEMLT32_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M]); + +#endif diff --git a/crypto_kem/ledakemlt32/leaktime/gf2x_arith.c b/crypto_kem/ledakemlt32/leaktime/gf2x_arith.c new file mode 100644 index 00000000..c421b02d --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/gf2x_arith.c @@ -0,0 +1,73 @@ +#include "gf2x_arith.h" + +#include // memset(...) + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_add(DIGIT Res[], const DIGIT A[], const DIGIT B[], int nr) { + for (int i = 0; i < nr; i++) { + Res[i] = A[i] ^ B[i]; + } +} + +/* PRE: MAX ALLOWED ROTATION AMOUNT : DIGIT_SIZE_b */ +void PQCLEAN_LEDAKEMLT32_LEAKTIME_right_bit_shift_n(int length, DIGIT in[], unsigned int amount) { + if ( amount == 0 ) { + return; + } + unsigned int j; + DIGIT mask; + mask = ((DIGIT)0x01 << amount) - 1; + for (j = length - 1; j > 0 ; j--) { + in[j] >>= amount; + in[j] |= (in[j - 1] & mask) << (DIGIT_SIZE_b - amount); + } + in[j] >>= amount; +} + +/* PRE: MAX ALLOWED ROTATION AMOUNT : DIGIT_SIZE_b */ +void PQCLEAN_LEDAKEMLT32_LEAKTIME_left_bit_shift_n(int length, DIGIT in[], unsigned int amount) { + if ( amount == 0 ) { + return; + } + int j; + DIGIT mask; + mask = ~(((DIGIT)0x01 << (DIGIT_SIZE_b - amount)) - 1); + for (j = 0 ; j < length - 1 ; j++) { + in[j] <<= amount; + in[j] |= (in[j + 1] & mask) >> (DIGIT_SIZE_b - amount); + } + in[j] <<= amount; +} + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mul_comb(int nr, DIGIT Res[], + int na, const DIGIT A[], + int nb, const DIGIT B[]) { + int i, j, k; + DIGIT u, h; + + memset(Res, 0x00, nr * sizeof(DIGIT)); + + for (k = DIGIT_SIZE_b - 1; k > 0; k--) { + for (i = na - 1; i >= 0; i--) { + if ( A[i] & (((DIGIT)0x1) << k) ) { + for (j = nb - 1; j >= 0; j--) { + Res[i + j + 1] ^= B[j]; + } + } + } + + u = Res[na + nb - 1]; + Res[na + nb - 1] = u << 0x1; + for (j = 1; j < na + nb; ++j) { + h = u >> (DIGIT_SIZE_b - 1); + u = Res[na + nb - 1 - j]; + Res[na + nb - 1 - j] = h ^ (u << 0x1); + } + } + for (i = na - 1; i >= 0; i--) { + if ( A[i] & ((DIGIT)0x1) ) { + for (j = nb - 1; j >= 0; j--) { + Res[i + j + 1] ^= B[j]; + } + } + } +} diff --git a/crypto_kem/ledakemlt32/leaktime/gf2x_arith.h b/crypto_kem/ledakemlt32/leaktime/gf2x_arith.h new file mode 100644 index 00000000..ff127b2b --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/gf2x_arith.h @@ -0,0 +1,58 @@ +#ifndef GF2X_ARITH_H +#define GF2X_ARITH_H + +#include +#include + +/* + * Elements of GF(2)[x] are stored in compact dense binary form. + * + * Each bit in a byte is assumed to be the coefficient of a binary + * polynomial f(x), in Big-Endian format (i.e., reading everything from + * left to right, the most significant element is met first): + * + * byte:(0000 0000) == 0x00 ... f(x) == 0 + * byte:(0000 0001) == 0x01 ... f(x) == 1 + * byte:(0000 0010) == 0x02 ... f(x) == x + * byte:(0000 0011) == 0x03 ... f(x) == x+1 + * ... ... ... + * byte:(0000 1111) == 0x0F ... f(x) == x^{3}+x^{2}+x+1 + * ... ... ... + * byte:(1111 1111) == 0xFF ... f(x) == x^{7}+x^{6}+x^{5}+x^{4}+x^{3}+x^{2}+x+1 + * + * + * A "machine word" (A_i) is considered as a DIGIT. + * Bytes in a DIGIT are assumed in Big-Endian format: + * E.g., if sizeof(DIGIT) == 4: + * A_i: A_{i,3} A_{i,2} A_{i,1} A_{i,0}. + * A_{i,3} denotes the most significant byte, A_{i,0} the least significant one. + * f(x) == x^{31} + ... + x^{24} + + * + x^{23} + ... + x^{16} + + * + x^{15} + ... + x^{8} + + * + x^{7} + ... + x^{0} + * + * + * Multi-precision elements (i.e., with multiple DIGITs) are stored in + * Big-endian format: + * A = A_{n-1} A_{n-2} ... A_1 A_0 + * + * position[A_{n-1}] == 0 + * position[A_{n-2}] == 1 + * ... + * position[A_{1}] == n-2 + * position[A_{0}] == n-1 + */ + +typedef uint64_t DIGIT; +#define DIGIT_SIZE_B (8) +#define DIGIT_SIZE_b (DIGIT_SIZE_B << 3) +#define POSITION_T uint32_t + +#define GF2X_MUL PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mul_comb + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_add(DIGIT Res[], const DIGIT A[], const DIGIT B[], int nr); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_right_bit_shift_n(int length, DIGIT in[], unsigned int amount); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_left_bit_shift_n(int length, DIGIT in[], unsigned int amount); +void GF2X_MUL(int nr, DIGIT Res[], int na, const DIGIT A[], int nb, const DIGIT B[]); + +#endif diff --git a/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.c b/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.c new file mode 100644 index 00000000..9576d55d --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.c @@ -0,0 +1,581 @@ +#include "gf2x_arith_mod_xPplusOne.h" +#include "rng.h" + +#include // memcpy(...), memset(...) + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { + for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { + dest[i] = in[i]; + } +} + +/* returns the coefficient of the x^exponent term as the LSB of a digit */ +DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) { + unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; + unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; + return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; +} + +/* sets the coefficient of the x^exponent term as the LSB of a digit */ +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) { + unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; + unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; + + /* clear given coefficient */ + DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + poly[digitIdx] = poly[digitIdx] & mask; + poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); +} + +/* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) { + unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; + unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; + + /* clear given coefficient */ + DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + poly[digitIdx] = poly[digitIdx] ^ mask; +} + +/* population count for an unsigned 64-bit integer + Source: Hacker's delight, p.66 */ +static int popcount_uint64t(uint64_t x) { + x -= (x >> 1) & 0x5555555555555555; + x = (x & 0x3333333333333333) + ((x >> 2) & 0x3333333333333333); + x = (x + (x >> 4)) & 0x0f0f0f0f0f0f0f0f; + return (int)((x * 0x0101010101010101) >> 56); +} + +/* population count for a single polynomial */ +int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(DIGIT *poly) { + int ret = 0; + for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { + ret += popcount_uint64t(poly[i]); + } + return ret; +} + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_add(Res, A, B, NUM_DIGITS_GF2X_ELEMENT); +} + +static int partition(POSITION_T arr[], int lo, int hi) { + POSITION_T x = arr[hi]; + POSITION_T tmp; + int i = (lo - 1); + for (int j = lo; j <= hi - 1; j++) { + if (arr[j] <= x) { + i++; + tmp = arr[i]; + arr[i] = arr[j]; + arr[j] = tmp; + } + } + tmp = arr[i + 1]; + arr[i + 1] = arr[hi]; + arr[hi] = tmp; + + return i + 1; +} + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_quicksort_sparse(POSITION_T Res[]) { + int stack[DV * M]; + int hi, lo, pivot, tos = -1; + stack[++tos] = 0; + stack[++tos] = (DV * M) - 1; + while (tos >= 0 ) { + hi = stack[tos--]; + lo = stack[tos--]; + pivot = partition(Res, lo, hi); + if ( (pivot - 1) > lo) { + stack[++tos] = lo; + stack[++tos] = pivot - 1; + } + if ( (pivot + 1) < hi) { + stack[++tos] = pivot + 1; + stack[++tos] = hi; + } + } +} + +static void gf2x_mod(DIGIT out[], const DIGIT in[]) { + + int i, j, posTrailingBit, maskOffset; + DIGIT mask, aux[2 * NUM_DIGITS_GF2X_ELEMENT]; + + memcpy(aux, in, 2 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + memset(out, 0x00, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + + for (i = 0; i < (2 * NUM_DIGITS_GF2X_ELEMENT) - NUM_DIGITS_GF2X_MODULUS; i += 1) { + for (j = DIGIT_SIZE_b - 1; j >= 0; j--) { + mask = ((DIGIT)0x1) << j; + if (aux[i] & mask) { + aux[i] ^= mask; + posTrailingBit = (DIGIT_SIZE_b - 1 - j) + i * DIGIT_SIZE_b + P; + maskOffset = (DIGIT_SIZE_b - 1 - (posTrailingBit % DIGIT_SIZE_b)); + mask = (DIGIT) 0x1 << maskOffset; + aux[posTrailingBit / DIGIT_SIZE_b] ^= mask; + } + } + } + + for (j = DIGIT_SIZE_b - 1; j >= MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS; j--) { + mask = ((DIGIT)0x1) << j; + if (aux[i] & mask) { + aux[i] ^= mask; + posTrailingBit = (DIGIT_SIZE_b - 1 - j) + i * DIGIT_SIZE_b + P; + maskOffset = (DIGIT_SIZE_b - 1 - (posTrailingBit % DIGIT_SIZE_b)); + mask = (DIGIT) 0x1 << maskOffset; + aux[posTrailingBit / DIGIT_SIZE_b] ^= mask; + } + } + + for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + out[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = aux[2 * NUM_DIGITS_GF2X_ELEMENT - 1 - i]; + } + +} + +static void left_bit_shift(const int length, DIGIT in[]) { + + int j; + for (j = 0; j < length - 1; j++) { + in[j] <<= 1; /* logical shift does not need clearing */ + in[j] |= in[j + 1] >> (DIGIT_SIZE_b - 1); + } + in[j] <<= 1; +} + +static void right_bit_shift(unsigned int length, DIGIT in[]) { + + unsigned int j; + for (j = length - 1; j > 0 ; j--) { + in[j] >>= 1; + in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); + } + in[j] >>= 1; +} + + +/* shifts by whole digits */ +static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) { + unsigned int j; + for (j = 0; (j + amount) < length; j++) { + in[j] = in[j + amount]; + } + for (; j < length; j++) { + in[j] = (DIGIT)0; + } +} + +/* may shift by an arbitrary amount*/ +static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) { + left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); + PQCLEAN_LEDAKEMLT32_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); +} + +/* Hackers delight, reverses a uint64_t */ +static DIGIT reverse_digit(DIGIT x) { + uint64_t t; + x = (x << 31) | (x >> 33); + t = (x ^ (x >> 20)) & 0x00000FFF800007FFLL; + x = (t | (t << 20)) ^ x; + t = (x ^ (x >> 8)) & 0x00F8000F80700807LL; + x = (t | (t << 8)) ^ x; + t = (x ^ (x >> 4)) & 0x0808708080807008LL; + x = (t | (t << 4)) ^ x; + t = (x ^ (x >> 2)) & 0x1111111111111111LL; + x = (t | (t << 2)) ^ x; + return x; +} + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) { + /* it keeps the lsb in the same position and + * inverts the sequence of the remaining bits */ + + DIGIT mask = (DIGIT)0x1; + DIGIT rev1, rev2, a00; + int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; + + a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; + right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); + + for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { + rev1 = reverse_digit(A[i]); + rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); + A[i] = rev2; + A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; + } + + if (slack_bits_amount) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); + } + A[NUM_DIGITS_GF2X_ELEMENT - 1] = (A[NUM_DIGITS_GF2X_ELEMENT - 1] & (~mask)) | a00; +} + +static void rotate_bit_left(DIGIT in[]) { /* equivalent to x * in(x) mod x^P+1 */ + + DIGIT mask, rotated_bit; + int msb_offset_in_digit = MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS - 1; + mask = ((DIGIT)0x1) << msb_offset_in_digit; + rotated_bit = !!(in[0] & mask); + in[0] &= ~mask; + left_bit_shift(NUM_DIGITS_GF2X_ELEMENT, in); + in[NUM_DIGITS_GF2X_ELEMENT - 1] |= rotated_bit; +} + +static void rotate_bit_right(DIGIT in[]) { /* x^{-1} * in(x) mod x^P+1 */ + + DIGIT rotated_bit = in[NUM_DIGITS_GF2X_ELEMENT - 1] & ((DIGIT)0x1); + right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, in); + int msb_offset_in_digit = MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS - 1; + rotated_bit = rotated_bit << msb_offset_in_digit; + in[0] |= rotated_bit; +} + +static void gf2x_swap(const int length, DIGIT f[], DIGIT s[]) { + DIGIT t; + for (int i = length - 1; i >= 0; i--) { + t = f[i]; + f[i] = s[i]; + s[i] = t; + } +} + +/* + * Optimized extended GCD algorithm to compute the multiplicative inverse of + * a non-zero element in GF(2)[x] mod x^P+1, in polyn. representation. + * + * H. Brunner, A. Curiger, and M. Hofstetter. 1993. + * On Computing Multiplicative Inverses in GF(2^m). + * IEEE Trans. Comput. 42, 8 (August 1993), 1010-1015. + * DOI=http://dx.doi.org/10.1109/12.238496 + * + * + * Henri Cohen, Gerhard Frey, Roberto Avanzi, Christophe Doche, Tanja Lange, + * Kim Nguyen, and Frederik Vercauteren. 2012. + * Handbook of Elliptic and Hyperelliptic Curve Cryptography, + * Second Edition (2nd ed.). Chapman & Hall/CRC. + * (Chapter 11 -- Algorithm 11.44 -- pag 223) + * + */ +int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { /* in^{-1} mod x^P-1 */ + + int i; + int delta = 0; + DIGIT u[NUM_DIGITS_GF2X_ELEMENT] = {0}; + DIGIT v[NUM_DIGITS_GF2X_ELEMENT] = {0}; + DIGIT s[NUM_DIGITS_GF2X_MODULUS] = {0}; + DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // alignas(32)? + + DIGIT mask; + u[NUM_DIGITS_GF2X_ELEMENT - 1] = 0x1; + v[NUM_DIGITS_GF2X_ELEMENT - 1] = 0x0; + + s[NUM_DIGITS_GF2X_MODULUS - 1] = 0x1; + + mask = (((DIGIT)0x1) << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); + s[0] |= mask; + + for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0 && in[i] == 0; i--) { }; + if (i < 0) { + return 0; + } + + for (i = NUM_DIGITS_GF2X_MODULUS - 1; i >= 0 ; i--) { + f[i] = in[i]; + } + + for (i = 1; i <= 2 * P; i++) { + if ( (f[0] & mask) == 0 ) { + left_bit_shift(NUM_DIGITS_GF2X_MODULUS, f); + rotate_bit_left(u); + delta += 1; + } else { + if ( (s[0] & mask) != 0) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_add(s, s, f, NUM_DIGITS_GF2X_MODULUS); + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add(v, v, u); + } + left_bit_shift(NUM_DIGITS_GF2X_MODULUS, s); + if ( delta == 0 ) { + gf2x_swap(NUM_DIGITS_GF2X_MODULUS, f, s); + gf2x_swap(NUM_DIGITS_GF2X_ELEMENT, u, v); + rotate_bit_left(u); + delta = 1; + } else { + rotate_bit_right(u); + delta = delta - 1; + } + } + } + + for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0 ; i--) { + out[i] = u[i]; + } + + return (delta == 0); +} + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]) { + + DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT]; + GF2X_MUL(2 * NUM_DIGITS_GF2X_ELEMENT, aux, + NUM_DIGITS_GF2X_ELEMENT, A, + NUM_DIGITS_GF2X_ELEMENT, B); + gf2x_mod(Res, aux); + +} + +/*PRE: the representation of the sparse coefficients is sorted in increasing + order of the coefficients themselves */ +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse( + DIGIT Res[], + const DIGIT dense[], + POSITION_T sparse[], unsigned int nPos) { + + DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; + DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; + memcpy(aux + NUM_DIGITS_GF2X_ELEMENT, dense, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + memcpy(resDouble + NUM_DIGITS_GF2X_ELEMENT, dense, + NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + + if (sparse[0] != INVALID_POS_VALUE) { + left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); + left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); + + for (unsigned int i = 1; i < nPos; i++) { + if (sparse[i] != INVALID_POS_VALUE) { + left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); + } + } + } + + gf2x_mod(Res, resDouble); + +} + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) { + + POSITION_T t; + int i = 0, j; + + if (A[i] == 0) { + i = 1; + } + j = i; + + for (; i < sizeA && A[i] != INVALID_POS_VALUE; i++) { + A[i] = P - A[i]; + } + + for (i -= 1; j < i; j++, i--) { + t = A[j]; + A[j] = A[i]; + A[i] = t; + } + +} + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], + size_t sizeA, const POSITION_T A[], + size_t sizeB, const POSITION_T B[]) { + + /* compute all the coefficients, filling invalid positions with P*/ + size_t lastFilledPos = 0; + for (size_t i = 0 ; i < sizeA ; i++) { + for (size_t j = 0 ; j < sizeB ; j++) { + uint32_t prod = A[i] + B[j]; + prod = ( (prod >= P) ? prod - P : prod); + if ((A[i] != INVALID_POS_VALUE) && + (B[j] != INVALID_POS_VALUE)) { + Res[lastFilledPos] = prod; + } else { + Res[lastFilledPos] = INVALID_POS_VALUE; + } + lastFilledPos++; + } + } + while (lastFilledPos < sizeR) { + Res[lastFilledPos] = INVALID_POS_VALUE; + lastFilledPos++; + } + PQCLEAN_LEDAKEMLT32_LEAKTIME_quicksort_sparse(Res); + /* eliminate duplicates */ + POSITION_T lastReadPos = Res[0]; + int duplicateCount; + size_t write_idx = 0; + size_t read_idx = 0; + while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { + lastReadPos = Res[read_idx]; + read_idx++; + duplicateCount = 1; + while ( (Res[read_idx] == lastReadPos) && (Res[read_idx] != INVALID_POS_VALUE)) { + read_idx++; + duplicateCount++; + } + if (duplicateCount % 2) { + Res[write_idx] = lastReadPos; + write_idx++; + } + } + /* fill remaining cells with INVALID_POS_VALUE */ + for (; write_idx < sizeR; write_idx++) { + Res[write_idx] = INVALID_POS_VALUE; + } +} + +/* the implementation is safe even in case A or B alias with the result + * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse( + int sizeR, POSITION_T Res[], + int sizeA, const POSITION_T A[], + int sizeB, const POSITION_T B[]) { + + POSITION_T tmpRes[DV * M]; + int idxA = 0, idxB = 0, idxR = 0; + while ( idxA < sizeA && + idxB < sizeB && + A[idxA] != INVALID_POS_VALUE && + B[idxB] != INVALID_POS_VALUE ) { + + if (A[idxA] == B[idxB]) { + idxA++; + idxB++; + } else { + if (A[idxA] < B[idxB]) { + tmpRes[idxR] = A[idxA]; + idxA++; + } else { + tmpRes[idxR] = B[idxB]; + idxB++; + } + idxR++; + } + } + + while (idxA < sizeA && A[idxA] != INVALID_POS_VALUE) { + tmpRes[idxR] = A[idxA]; + idxA++; + idxR++; + } + + while (idxB < sizeB && B[idxB] != INVALID_POS_VALUE) { + tmpRes[idxR] = B[idxB]; + idxB++; + idxR++; + } + + while (idxR < sizeR) { + tmpRes[idxR] = INVALID_POS_VALUE; + idxR++; + } + memcpy(Res, tmpRes, sizeof(POSITION_T)*sizeR); + +} + +/* Return a uniform random value in the range 0..n-1 inclusive, + * applying a rejection sampling strategy and exploiting as a random source + * the NIST seedexpander seeded with the proper key. + * Assumes that the maximum value for the range n is 2^32-1 + */ +static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct *seed_expander_ctx) { + unsigned long required_rnd_bytes = (logn + 7) / 8; + unsigned char rnd_char_buffer[4]; + uint32_t rnd_value; + uint32_t mask = ( (uint32_t)1 << logn) - 1; + + do { + PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(seed_expander_ctx, rnd_char_buffer, required_rnd_bytes); + /* obtain an endianness independent representation of the generated random + bytes into an unsigned integer */ + rnd_value = ((uint32_t)rnd_char_buffer[3] << 24) + + ((uint32_t)rnd_char_buffer[2] << 16) + + ((uint32_t)rnd_char_buffer[1] << 8) + + ((uint32_t)rnd_char_buffer[0] << 0) ; + rnd_value = mask & rnd_value; + } while (rnd_value >= n); + + return rnd_value; +} + +/* Obtains fresh randomness and seed-expands it until all the required positions + * for the '1's in the circulant block are obtained */ +void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, + int countOnes, + AES_XOF_struct *seed_expander_ctx) { + + int duplicated, placedOnes = 0; + uint32_t p; + + while (placedOnes < countOnes) { + p = rand_range(NUM_BITS_GF2X_ELEMENT, + P_BITS, + seed_expander_ctx); + duplicated = 0; + for (int j = 0; j < placedOnes; j++) { + if (pos_ones[j] == p) { + duplicated = 1; + } + } + if (duplicated == 0) { + pos_ones[placedOnes] = p; + placedOnes++; + } + } +} + +/* Returns random weight-t circulant block */ +void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_blocks_sequence( + DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], + AES_XOF_struct *seed_expander_ctx) { + + int rndPos[NUM_ERRORS_T], duplicated, counter = 0; + int p, polyIndex, exponent; + + memset(sequence, 0x00, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + + while (counter < NUM_ERRORS_T) { + p = rand_range(N0 * NUM_BITS_GF2X_ELEMENT, P_BITS, + seed_expander_ctx); + duplicated = 0; + for (int j = 0; j < counter; j++) { + if (rndPos[j] == p) { + duplicated = 1; + } + } + if (duplicated == 0) { + rndPos[counter] = p; + counter++; + } + } + for (int j = 0; j < counter; j++) { + polyIndex = rndPos[j] / P; + exponent = rndPos[j] % P; + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff( sequence + NUM_DIGITS_GF2X_ELEMENT * polyIndex, exponent, + ( (DIGIT) 1)); + } + +} + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly) { + size_t i, j; + for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + for (j = 0; j < DIGIT_SIZE_B; j++) { + bytes[i * DIGIT_SIZE_B + j] = (uint8_t) (poly[i] >> 8 * j); + } + } +} + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes) { + size_t i, j; + for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + poly[i] = (DIGIT) 0; + for (j = 0; j < DIGIT_SIZE_B; j++) { + poly[i] |= (DIGIT) poly_bytes[i * DIGIT_SIZE_B + j] << 8 * j; + } + } +} diff --git a/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.h b/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.h new file mode 100644 index 00000000..a43f1225 --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.h @@ -0,0 +1,38 @@ +#ifndef GF2X_ARITH_MOD_XPLUSONE_H +#define GF2X_ARITH_MOD_XPLUSONE_H + +#include "qc_ldpc_parameters.h" + +#include "gf2x_arith.h" +#include "rng.h" + +#define NUM_BITS_GF2X_ELEMENT (P) // 96221 +#define NUM_DIGITS_GF2X_ELEMENT ((P+DIGIT_SIZE_b-1)/DIGIT_SIZE_b) +#define MSb_POSITION_IN_MSB_DIGIT_OF_ELEMENT ((P % DIGIT_SIZE_b) ? (P % DIGIT_SIZE_b)-1 : DIGIT_SIZE_b-1) +#define NUM_BITS_GF2X_MODULUS (P+1) +#define NUM_DIGITS_GF2X_MODULUS ((P+1+DIGIT_SIZE_b-1)/DIGIT_SIZE_b) +#define MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS (P-DIGIT_SIZE_b*(NUM_DIGITS_GF2X_MODULUS-1)) +#define INVALID_POS_VALUE (P) +#define P_BITS (17) // log_2(p) = 16.55406417 + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); +DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent); +int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(DIGIT *poly); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_quicksort_sparse(POSITION_T Res[]); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]); +int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); + + +#endif diff --git a/crypto_kem/ledakemlt32/leaktime/kem.c b/crypto_kem/ledakemlt32/leaktime/kem.c new file mode 100644 index 00000000..d7e09732 --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/kem.c @@ -0,0 +1,92 @@ +#include "api.h" +#include "niederreiter.h" +#include "randombytes.h" +#include "rng.h" + +#include + +static void pack_pk(uint8_t *pk_bytes, publicKeyNiederreiter_t *pk) { + size_t i; + for (i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_tobytes(pk_bytes + i * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B, + pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); + } +} + +static void unpack_pk(publicKeyNiederreiter_t *pk, const uint8_t *pk_bytes) { + size_t i; + for (i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_frombytes(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, + pk_bytes + i * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + } +} + +static void pack_ct(uint8_t *sk_bytes, DIGIT *ct) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_tobytes(sk_bytes, ct); +} + +static void unpack_ct(DIGIT *ct, const uint8_t *ct_bytes) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_frombytes(ct, ct_bytes); +} + +static void pack_error(uint8_t *error_bytes, DIGIT *error_digits) { + size_t i; + for (i = 0; i < N0; i++) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_tobytes(error_bytes + i * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B, + error_digits + i * NUM_DIGITS_GF2X_ELEMENT); + } +} + +/* Generates a keypair - pk is the public key and sk is the secret key. */ +int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_keypair(unsigned char *pk, unsigned char *sk) { + AES_XOF_struct niederreiter_keys_expander; + publicKeyNiederreiter_t pk_nie; + + randombytes(((privateKeyNiederreiter_t *)sk)->prng_seed, TRNG_BYTE_LENGTH); + PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(&niederreiter_keys_expander, ((privateKeyNiederreiter_t *)sk)->prng_seed); + PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_keygen(&pk_nie, (privateKeyNiederreiter_t *) sk, &niederreiter_keys_expander); + + pack_pk(pk, &pk_nie); + + return 0; +} + +/* Encrypt - pk is the public key, ct is a key encapsulation message + (ciphertext), ss is the shared secret.*/ +int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk) { + AES_XOF_struct niederreiter_encap_key_expander; + unsigned char encapsulated_key_seed[TRNG_BYTE_LENGTH]; + DIGIT error_vector[N0 * NUM_DIGITS_GF2X_ELEMENT]; + uint8_t error_bytes[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; + DIGIT syndrome[NUM_DIGITS_GF2X_ELEMENT]; + publicKeyNiederreiter_t pk_nie; + + randombytes(encapsulated_key_seed, TRNG_BYTE_LENGTH); + unpack_pk(&pk_nie, pk); + + PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(&niederreiter_encap_key_expander, encapsulated_key_seed); + PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_blocks_sequence(error_vector, &niederreiter_encap_key_expander); + pack_error(error_bytes, error_vector); + HASH_FUNCTION(ss, error_bytes, (N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B)); + PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_encrypt(syndrome, &pk_nie, error_vector); + + pack_ct(ct, syndrome); + + return 0; +} + + +/* Decrypt - ct is a key encapsulation message (ciphertext), sk is the private + key, ss is the shared secret */ +int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk) { + DIGIT decoded_error_vector[N0 * NUM_DIGITS_GF2X_ELEMENT]; + uint8_t decoded_error_bytes[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; + DIGIT syndrome[NUM_DIGITS_GF2X_ELEMENT]; + + unpack_ct(syndrome, ct); + PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(decoded_error_vector, (privateKeyNiederreiter_t *)sk, syndrome); + pack_error(decoded_error_bytes, decoded_error_vector); + HASH_FUNCTION(ss, decoded_error_bytes, (N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B)); + + return 0; +} diff --git a/crypto_kem/ledakemlt32/leaktime/niederreiter.c b/crypto_kem/ledakemlt32/leaktime/niederreiter.c new file mode 100644 index 00000000..66bc3f80 --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/niederreiter.c @@ -0,0 +1,192 @@ +#include "H_Q_matrices_generation.h" +#include "bf_decoding.h" +#include "dfr_test.h" +#include "gf2x_arith_mod_xPplusOne.h" +#include "niederreiter.h" +#include "qc_ldpc_parameters.h" +#include "rng.h" + +#include + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *pk, privateKeyNiederreiter_t *sk, AES_XOF_struct *keys_expander) { + + POSITION_T HPosOnes[N0][DV]; // sequence of N0 circ block matrices (p x p): Hi + POSITION_T HtrPosOnes[N0][DV]; // Sparse tranposed circulant H + POSITION_T QPosOnes[N0][M]; // Sparse Q, Each row contains the position of the ones of all the blocks of a row of Q as exponent+P*block_position + POSITION_T LPosOnes[N0][DV * M]; + POSITION_T auxPosOnes[DV * M]; + unsigned char processedQOnes[N0]; + DIGIT Ln0dense[NUM_DIGITS_GF2X_ELEMENT]; + DIGIT Ln0Inv[NUM_DIGITS_GF2X_ELEMENT]; + int is_L_full = 0; + uint8_t threshold = (DV * M) / 2 + 1; // threshold for round 2 + sk->rejections = (int8_t) 0; + + do { + PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes_HtrPosOnes(HPosOnes, HtrPosOnes, keys_expander); + PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQsparse(QPosOnes, keys_expander); + for (int i = 0; i < N0; i++) { + for (int j = 0; j < DV * M; j++) { + LPosOnes[i][j] = INVALID_POS_VALUE; + } + } + + memset(processedQOnes, 0x00, sizeof(processedQOnes)); + for (int colQ = 0; colQ < N0; colQ++) { + for (int i = 0; i < N0; i++) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, + DV, HPosOnes[i], + qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(DV * M, LPosOnes[colQ], + DV * M, LPosOnes[colQ], + DV * M, auxPosOnes); + processedQOnes[i] += qBlockWeights[i][colQ]; + } + } + is_L_full = 1; + for (int i = 0; i < N0; i++) { + is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); + } + sk->rejections = sk->rejections + 1; + if (is_L_full) { + threshold = PQCLEAN_LEDAKEMLT32_LEAKTIME_DFR_test(LPosOnes); + } + } while (!is_L_full || threshold == DFR_TEST_FAIL); + sk->rejections = sk->rejections - 1; + sk->threshold = threshold; + + memset(Ln0dense, 0x00, sizeof(Ln0dense)); + for (int j = 0; j < DV * M; j++) { + if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); + } + } + + memset(Ln0Inv, 0x00, sizeof(Ln0Inv)); + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); + for (int i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, + Ln0Inv, + LPosOnes[i], + DV * M); + } + + for (int i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); + } +} + + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_encrypt(DIGIT *syndrome, const publicKeyNiederreiter_t *pk, const DIGIT *err) { + int i; + DIGIT saux[NUM_DIGITS_GF2X_ELEMENT]; + + memset(syndrome, 0x00, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + for (i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul(saux, + pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, + err + i * NUM_DIGITS_GF2X_ELEMENT); + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add(syndrome, syndrome, saux); + } + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add(syndrome, syndrome, err + (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT); +} + + +int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateKeyNiederreiter_t *sk, const DIGIT *syndrome) { + AES_XOF_struct niederreiter_decrypt_expander; + POSITION_T HPosOnes[N0][DV]; + POSITION_T HtrPosOnes[N0][DV]; + POSITION_T QPosOnes[N0][M]; + POSITION_T QtrPosOnes[N0][M]; + POSITION_T auxPosOnes[DV * M]; + POSITION_T LPosOnes[N0][DV * M]; + POSITION_T auxSparse[DV * M]; + POSITION_T Ln0trSparse[DV * M]; + unsigned char processedQOnes[N0]; + unsigned transposed_ones_idx[N0]; + DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; + DIGIT mockup_error_vector[N0 * NUM_DIGITS_GF2X_ELEMENT]; + int rejections = sk->rejections; + int currQoneIdx, endQblockIdx; + int decryptOk, err_weight; + + PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); + + do { + PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes_HtrPosOnes(HPosOnes, HtrPosOnes, &niederreiter_decrypt_expander); + PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQsparse(QPosOnes, &niederreiter_decrypt_expander); + for (int i = 0; i < N0; i++) { + for (int j = 0; j < DV * M; j++) { + LPosOnes[i][j] = INVALID_POS_VALUE; + } + } + + memset(processedQOnes, 0x00, sizeof(processedQOnes)); + for (int colQ = 0; colQ < N0; colQ++) { + for (int i = 0; i < N0; i++) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, + DV, HPosOnes[i], + qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(DV * M, LPosOnes[colQ], + DV * M, LPosOnes[colQ], + DV * M, auxPosOnes); + processedQOnes[i] += qBlockWeights[i][colQ]; + } + } + rejections--; + } while (rejections >= 0); + + memset(transposed_ones_idx, 0x00, sizeof(transposed_ones_idx)); + for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { + currQoneIdx = 0; // position in the column of QtrPosOnes[][...] + endQblockIdx = 0; + for (int blockIdx = 0; blockIdx < N0; blockIdx++) { + endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; + for (; currQoneIdx < endQblockIdx; currQoneIdx++) { + QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P - + QPosOnes[source_row_idx][currQoneIdx]) % P; + transposed_ones_idx[blockIdx]++; + } + } + } + + for (int i = 0; i < DV * M; i++) { + Ln0trSparse[i] = INVALID_POS_VALUE; + auxSparse[i] = INVALID_POS_VALUE; + } + + for (int i = 0; i < N0; i++) { + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, + DV, HPosOnes[i], + qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1]]); + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, + DV * M, Ln0trSparse, + DV * M, auxSparse); + } + + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(DV * M, Ln0trSparse); + PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(privateSyndrome, syndrome, Ln0trSparse, DV * M); + + /* prepare mockup error vector in case a decoding failure occurs */ + memset(mockup_error_vector, 0x00, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + memcpy(mockup_error_vector, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(&niederreiter_decrypt_expander, + ((unsigned char *) mockup_error_vector) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B), + TRNG_BYTE_LENGTH); + + memset(err, 0x00, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + decryptOk = PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(err, (const POSITION_T (*)[DV]) HtrPosOnes, + (const POSITION_T (*)[M]) QtrPosOnes, privateSyndrome, sk->threshold); + + err_weight = 0; + for (int i = 0 ; i < N0; i++) { + err_weight += PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(err + (NUM_DIGITS_GF2X_ELEMENT * i)); + } + decryptOk = decryptOk && (err_weight == NUM_ERRORS_T); + + if (!decryptOk) { // TODO: not constant time, replace with cmov? + memcpy(err, mockup_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + } + + return decryptOk; +} diff --git a/crypto_kem/ledakemlt32/leaktime/niederreiter.h b/crypto_kem/ledakemlt32/leaktime/niederreiter.h new file mode 100644 index 00000000..a954718d --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/niederreiter.h @@ -0,0 +1,29 @@ +#ifndef NIEDERREITER_H +#define NIEDERREITER_H + +#include "gf2x_arith_mod_xPplusOne.h" +#include "qc_ldpc_parameters.h" +#include "rng.h" + +typedef struct { + /* raw entropy extracted from TRNG, will be deterministically expanded into + * H and Q during decryption */ + unsigned char prng_seed[TRNG_BYTE_LENGTH]; + int8_t rejections; + uint8_t threshold; // for round 2 +} privateKeyNiederreiter_t; + +typedef struct { + DIGIT Mtr[(N0 - 1)*NUM_DIGITS_GF2X_ELEMENT]; + // Dense representation of the matrix M=Ln0*L, + // An array including a sequence of (N0-1) gf2x elements; + // each gf2x element is stored as a binary polynomial(mod x^P+1) + // with P coefficients. +} publicKeyNiederreiter_t; + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *pk, privateKeyNiederreiter_t *sk, AES_XOF_struct *keys_expander); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_encrypt(DIGIT syndrome[], const publicKeyNiederreiter_t *pk, const DIGIT *err); +int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateKeyNiederreiter_t *sk, const DIGIT *syndrome); + + +#endif diff --git a/crypto_kem/ledakemlt32/leaktime/qc_ldpc_parameters.h b/crypto_kem/ledakemlt32/leaktime/qc_ldpc_parameters.h new file mode 100644 index 00000000..5e58fcdc --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/qc_ldpc_parameters.h @@ -0,0 +1,27 @@ +#ifndef QC_LDPC_PARAMETERS_H +#define QC_LDPC_PARAMETERS_H + +#include "fips202.h" + +#define TRNG_BYTE_LENGTH (32) +#define HASH_BYTE_LENGTH (48) +#define HASH_FUNCTION sha3_384 + +#define N0 (2) +#define P (96221) // modulus(x) = x^P-1 +#define DV (11) // odd number +#define M (11) +#define M0 (6) +#define M1 (5) +#define NUM_ERRORS_T (199) + +// Derived parameters, they are useful for QC-LDPC algorithms +#define HASH_BIT_LENGTH (HASH_BYTE_LENGTH << 3) +#define K ((N0-1)*P) +#define N (N0*P) +#define DC (N0*DV) + +#define Q_BLOCK_WEIGHTS {{M0,M1},{M1,M0}} +static const unsigned char qBlockWeights[N0][N0] = Q_BLOCK_WEIGHTS; + +#endif diff --git a/crypto_kem/ledakemlt32/leaktime/rng.c b/crypto_kem/ledakemlt32/leaktime/rng.c new file mode 100644 index 00000000..4e18fa57 --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/rng.c @@ -0,0 +1,108 @@ +#include "rng.h" + +#include // void *memset(void *s, int c, size_t n); + +#include "aes.h" +#include "qc_ldpc_parameters.h" + +/* + seedexpander_init() + ctx - stores the current state of an instance of the seed expander + seed - a 32 byte random value + diversifier - an 8 byte diversifier + maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier + */ +static void seedexpander_init(AES_XOF_struct *ctx, + unsigned char *seed, + unsigned char *diversifier, + size_t maxlen) { + + ctx->length_remaining = maxlen; + + memset(ctx->key, 0, 32); + int max_accessible_seed_len = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; + memcpy(ctx->key, seed, max_accessible_seed_len); + + memcpy(ctx->ctr, diversifier, 8); + ctx->ctr[11] = maxlen % 256; + maxlen >>= 8; + ctx->ctr[10] = maxlen % 256; + maxlen >>= 8; + ctx->ctr[9] = maxlen % 256; + maxlen >>= 8; + ctx->ctr[8] = maxlen % 256; + memset(ctx->ctr + 12, 0x00, 4); + + ctx->buffer_pos = 16; + memset(ctx->buffer, 0x00, 16); +} + +void PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, + const unsigned char *trng_entropy + /* TRNG_BYTE_LENGTH wide buffer */) { + + /*the NIST seedexpander will however access 32B from this buffer */ + unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; + unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 }; + unsigned char diversifier[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; + + memcpy(prng_buffer, + trng_entropy, + TRNG_BYTE_LENGTH < prng_buffer_size ? TRNG_BYTE_LENGTH : prng_buffer_size); + + /* the required seed expansion will be quite small, set the max number of + * bytes conservatively to 10 MiB*/ + seedexpander_init(ctx, prng_buffer, diversifier, RNG_MAXLEN); +} + +/* + seedexpander() + ctx - stores the current state of an instance of the seed expander + x - returns the XOF data + xlen - number of bytes to return + */ +int PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) { + size_t offset; + aes256ctx ctx256; + + if ( x == NULL ) { + return RNG_BAD_OUTBUF; + } + if ( xlen >= ctx->length_remaining ) { + return RNG_BAD_REQ_LEN; + } + + aes256_keyexp(&ctx256, ctx->key); + ctx->length_remaining -= xlen; + + offset = 0; + while ( xlen > 0 ) { + if ( xlen <= (16 - ctx->buffer_pos) ) { // buffer has what we need + memcpy(x + offset, ctx->buffer + ctx->buffer_pos, xlen); + ctx->buffer_pos += xlen; + + return RNG_SUCCESS; + } + + // take what's in the buffer + memcpy(x + offset, ctx->buffer + ctx->buffer_pos, 16 - ctx->buffer_pos); + xlen -= 16 - ctx->buffer_pos; + offset += 16 - ctx->buffer_pos; + + aes256_ecb(ctx->buffer, ctx->ctr, 16 / AES_BLOCKBYTES, &ctx256); + ctx->buffer_pos = 0; + + //increment the counter + for (int i = 15; i >= 12; i--) { + if ( ctx->ctr[i] == 0xff ) { + ctx->ctr[i] = 0x00; + } else { + ctx->ctr[i]++; + break; + } + } + + } + + return RNG_SUCCESS; +} diff --git a/crypto_kem/ledakemlt32/leaktime/rng.h b/crypto_kem/ledakemlt32/leaktime/rng.h new file mode 100644 index 00000000..dbff0366 --- /dev/null +++ b/crypto_kem/ledakemlt32/leaktime/rng.h @@ -0,0 +1,24 @@ +#ifndef RNG_H +#define RNG_H + +#include +#include + +#define RNG_SUCCESS ( 0) +#define RNG_BAD_MAXLEN (-1) +#define RNG_BAD_OUTBUF (-2) +#define RNG_BAD_REQ_LEN (-3) +#define RNG_MAXLEN (10 * 1024 * 1024) + +typedef struct { + unsigned char buffer[16]; + size_t buffer_pos; + size_t length_remaining; + unsigned char key[32]; + unsigned char ctr[16]; +} AES_XOF_struct; + +int PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen); +void PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, const unsigned char *trng_entropy); + +#endif diff --git a/crypto_kem/ledakemlt52/META.yml b/crypto_kem/ledakemlt52/META.yml new file mode 100644 index 00000000..5aef2b59 --- /dev/null +++ b/crypto_kem/ledakemlt52/META.yml @@ -0,0 +1,18 @@ +name: LEDAcryptKEMLT52 +type: kem +claimed-nist-level: 5 +claimed-security: IND-CCA2 +length-public-key: 19040 +length-secret-key: 42 +length-ciphertext: 19040 +length-shared-secret: 64 +nistkat-sha256: 9cd9299d20a1c8c242730d3795683a9e87c6bcd0e691dc1fd54cd6a418266c36 +principal-submitter: Marco Baldi +auxiliary-submitters: + - Alessandro Barenghi + - Franco Chiaraluce + - Gerardo Pelosi + - Paolo Santini +implementations: + - name: leaktime + version: 2.? diff --git a/crypto_kem/ledakemlt52/leaktime/H_Q_matrices_generation.c b/crypto_kem/ledakemlt52/leaktime/H_Q_matrices_generation.c new file mode 100644 index 00000000..8c1cdf0f --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/H_Q_matrices_generation.c @@ -0,0 +1,32 @@ +#include "H_Q_matrices_generation.h" +#include "gf2x_arith_mod_xPplusOne.h" + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes_HtrPosOnes( + POSITION_T HPosOnes[N0][DV], + POSITION_T HtrPosOnes[N0][DV], + AES_XOF_struct *keys_expander) { + for (int i = 0; i < N0; i++) { + /* Generate a random block of Htr */ + PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&HtrPosOnes[i][0], DV, keys_expander); + } + for (int i = 0; i < N0; i++) { + /* Obtain directly the sparse representation of the block of H */ + for (int k = 0; k < DV; k++) { + HPosOnes[i][k] = (P - HtrPosOnes[i][k]) % P; /* transposes indexes */ + } + } +} + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQsparse( + POSITION_T pos_ones[N0][M], + AES_XOF_struct *keys_expander) { + for (int i = 0; i < N0; i++) { + int placed_ones = 0; + for (int j = 0; j < N0; j++) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&pos_ones[i][placed_ones], + qBlockWeights[i][j], + keys_expander); + placed_ones += qBlockWeights[i][j]; + } + } +} diff --git a/crypto_kem/ledakemlt52/leaktime/H_Q_matrices_generation.h b/crypto_kem/ledakemlt52/leaktime/H_Q_matrices_generation.h new file mode 100644 index 00000000..168fa743 --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/H_Q_matrices_generation.h @@ -0,0 +1,11 @@ +#ifndef H_Q_MATRICES_GENERATION_H +#define H_Q_MATRICES_GENERATION_H + +#include "gf2x_arith.h" +#include "qc_ldpc_parameters.h" +#include "rng.h" + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes_HtrPosOnes(POSITION_T HPosOnes[N0][DV], POSITION_T HtrPosOnes[N0][DV], AES_XOF_struct *niederreiter_keys_expander); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQsparse(POSITION_T pos_ones[N0][M], AES_XOF_struct *niederreiter_keys_expander); + +#endif diff --git a/crypto_kem/ledakemlt52/leaktime/LICENSE b/crypto_kem/ledakemlt52/leaktime/LICENSE new file mode 100644 index 00000000..c1761078 --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/LICENSE @@ -0,0 +1,31 @@ +/** + * + * LEDAcryptKEM + * + * @version 2.0 (March 2019) + * + * Adapted code from reference ISO-C11 Implementation of the LEDAcrypt KEM-LT cipher. + * + * In alphabetical order: + * + * @author Marco Baldi + * @author Alessandro Barenghi + * @author Franco Chiaraluce + * @author Gerardo Pelosi + * @author Paolo Santini + * + * This code is hereby placed in the public domain. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS + * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE + * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, + * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + **/ diff --git a/crypto_kem/ledakemlt52/leaktime/Makefile b/crypto_kem/ledakemlt52/leaktime/Makefile new file mode 100644 index 00000000..0c3b52fa --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/Makefile @@ -0,0 +1,24 @@ +# This Makefile can be used with GNU Make or BSD Make + +LIB=libledakemlt52_leaktime.a +HEADERS=api.h bf_decoding.h dfr_test.h gf2x_arith_mod_xPplusOne.h \ + gf2x_arith.h H_Q_matrices_generation.h \ + niederreiter.h qc_ldpc_parameters.h rng.h + +OBJECTS=bf_decoding.o dfr_test.o gf2x_arith_mod_xPplusOne.o \ + gf2x_arith.o H_Q_matrices_generation.o kem.o niederreiter.o rng.o + +CFLAGS=-O3 -Wall -Werror -Wextra -Wvla -Wpedantic -Wmissing-prototypes -std=c99 \ + -I../../../common $(EXTRAFLAGS) + +all: $(LIB) + +%.o: %.c $(HEADERS) + $(CC) $(CFLAGS) -c -o $@ $< + +$(LIB): $(OBJECTS) + $(AR) -r $@ $(OBJECTS) + +clean: + $(RM) $(OBJECTS) + $(RM) $(LIB) diff --git a/crypto_kem/ledakemlt52/leaktime/Makefile.Microsoft_nmake b/crypto_kem/ledakemlt52/leaktime/Makefile.Microsoft_nmake new file mode 100644 index 00000000..0bb72b8b --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/Makefile.Microsoft_nmake @@ -0,0 +1,19 @@ +# This Makefile can be used with Microsoft Visual Studio's nmake using the command: +# nmake /f Makefile.Microsoft_nmake + +LIBRARY=libledakemlt52_leaktime.lib +OBJECTS=bf_decoding.obj dfr_test.obj gf2x_arith_mod_xPplusOne.obj gf2x_arith.obj H_Q_matrices_generation.obj kem.obj niederreiter.obj rng.obj + +CFLAGS=/nologo /I ..\..\..\common /W4 /WX + +all: $(LIBRARY) + +# Make sure objects are recompiled if headers change. +$(OBJECTS): *.h + +$(LIBRARY): $(OBJECTS) + LIB.EXE /NOLOGO /WX /OUT:$@ $** + +clean: + -DEL $(OBJECTS) + -DEL $(LIBRARY) diff --git a/crypto_kem/ledakemlt52/leaktime/api.h b/crypto_kem/ledakemlt52/leaktime/api.h new file mode 100644 index 00000000..11c84a4d --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/api.h @@ -0,0 +1,18 @@ +#ifndef PQCLEAN_LEDAKEMLT52_LEAKTIME_API_H +#define PQCLEAN_LEDAKEMLT52_LEAKTIME_API_H + +#include + +#define PQCLEAN_LEDAKEMLT52_LEAKTIME_CRYPTO_SECRETKEYBYTES 42 +#define PQCLEAN_LEDAKEMLT52_LEAKTIME_CRYPTO_PUBLICKEYBYTES 19040 +#define PQCLEAN_LEDAKEMLT52_LEAKTIME_CRYPTO_CIPHERTEXTBYTES 19040 +#define PQCLEAN_LEDAKEMLT52_LEAKTIME_CRYPTO_BYTES 64 + +#define PQCLEAN_LEDAKEMLT52_LEAKTIME_CRYPTO_ALGNAME "LEDAKEMLT52" + +int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_keypair(uint8_t *pk, uint8_t *sk); +int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk); +int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk); + + +#endif diff --git a/crypto_kem/ledakemlt52/leaktime/bf_decoding.c b/crypto_kem/ledakemlt52/leaktime/bf_decoding.c new file mode 100644 index 00000000..4d35a3fd --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/bf_decoding.c @@ -0,0 +1,76 @@ +#include "bf_decoding.h" +#include "gf2x_arith_mod_xPplusOne.h" + +#include + +int PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(DIGIT err[], + const POSITION_T HtrPosOnes[N0][DV], + const POSITION_T QtrPosOnes[N0][M], + DIGIT privateSyndrome[], + uint8_t threshold) { + + uint8_t unsatParityChecks[N0 * P]; + POSITION_T currQBlkPos[M], currQBitPos[M]; + DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; + int check; + int iteration = 0; + unsigned int corrt_syndrome_based; + + do { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); + memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); + for (int i = 0; i < N0; i++) { + for (int valueIdx = 0; valueIdx < P; valueIdx++) { + for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { + POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx); + if (PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { + unsatParityChecks[i * P + valueIdx]++; + } + } + } + } + + /* iteration based threshold determination*/ + corrt_syndrome_based = iteration ? (unsigned int) threshold : B0; + + //Computation of correlation with a full Q matrix + for (int i = 0; i < N0; i++) { + for (int j = 0; j < P; j++) { + int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] + int endQblockIdx = 0; + unsigned int correlation = 0; + + for (int blockIdx = 0; blockIdx < N0; blockIdx++) { + endQblockIdx += qBlockWeights[blockIdx][i]; + int currblockoffset = blockIdx * P; + for (; currQoneIdx < endQblockIdx; currQoneIdx++) { + POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j; + tmp = tmp >= P ? tmp - P : tmp; + currQBitPos[currQoneIdx] = tmp; + currQBlkPos[currQoneIdx] = blockIdx; + correlation += unsatParityChecks[tmp + currblockoffset]; + } + } + /* Correlation based flipping */ + if (correlation >= corrt_syndrome_based) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); + for (int v = 0; v < M; v++) { + POSITION_T syndromePosToFlip; + for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { + syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] ); + syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); + } + } // end for v + } // end if + } // end for j + } // end for i + + iteration = iteration + 1; + check = 0; + while (check < NUM_DIGITS_GF2X_ELEMENT && privateSyndrome[check++] == 0) {}; + + } while (iteration < ITERATIONS_MAX && check < NUM_DIGITS_GF2X_ELEMENT); + + return (check == NUM_DIGITS_GF2X_ELEMENT); +} diff --git a/crypto_kem/ledakemlt52/leaktime/bf_decoding.h b/crypto_kem/ledakemlt52/leaktime/bf_decoding.h new file mode 100644 index 00000000..0b391c48 --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/bf_decoding.h @@ -0,0 +1,18 @@ +#ifndef BF_DECODING_H +#define BF_DECODING_H + +#include "gf2x_arith.h" +#include "qc_ldpc_parameters.h" + +/* Definitions for DFR level 2^-SL with SL=128 */ +#define ITERATIONS_MAX (2) +#define B0 (88) +#define T_BAR (6) + +int PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(DIGIT err[], + const POSITION_T HtrPosOnes[N0][DV], + const POSITION_T QtrPosOnes[N0][M], + DIGIT privateSyndrome[], + uint8_t threshold); + +#endif diff --git a/crypto_kem/ledakemlt52/leaktime/dfr_test.c b/crypto_kem/ledakemlt52/leaktime/dfr_test.c new file mode 100644 index 00000000..b93f68aa --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/dfr_test.c @@ -0,0 +1,112 @@ +#include "bf_decoding.h" +#include "dfr_test.h" +#include "gf2x_arith_mod_xPplusOne.h" +#include "qc_ldpc_parameters.h" + +#include + +/* Tests if the current code attains the desired DFR. If that is the case, + * computes the threshold for the second iteration of the decoder and returns this values + * (max DV * M), on failure it returns 255 >> DV * M */ + +uint8_t PQCLEAN_LEDAKEMLT52_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M]) { + + POSITION_T LSparse_loc[N0][DV * M]; + POSITION_T rotated_column[DV * M]; + /* Gamma matrix: an N0 x N0 block circulant matrix with block size p + * gamma[a][b][c] stores the intersection of the first column of the a-th + * block of L with the c-th column of the b-th block of L. + * Gamma computation can be accelerated employing symmetry and QC properties */ + unsigned int gamma[N0][N0][P] = {{{0}}}; + unsigned int gammaHist[N0][DV * M + 1] = {{0}}; + unsigned int maxMut[N0], maxMutMinusOne[N0]; + unsigned int firstidx, secondidx, intersectionval; + unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; + unsigned int toAdd, histIdx; + + /*transpose blocks of L, we need its columns */ + for (int i = 0; i < N0; i++) { + for (int j = 0; j < DV * M; j++) { + if (LSparse[i][j] != 0) { + LSparse_loc[i][j] = (P - LSparse[i][j]); + } + } + PQCLEAN_LEDAKEMLT52_LEAKTIME_quicksort_sparse(LSparse_loc[i]); + } + + for (int i = 0; i < N0; i++ ) { + for (int j = 0; j < N0; j++ ) { + for (int k = 0; k < P; k++) { + /* compute the rotated sparse column needed */ + for (int idxToRotate = 0; idxToRotate < (DV * M); idxToRotate++) { + rotated_column[idxToRotate] = (LSparse_loc[j][idxToRotate] + k) % P; + } + PQCLEAN_LEDAKEMLT52_LEAKTIME_quicksort_sparse(rotated_column); + /* compute the intersection amount */ + firstidx = 0, secondidx = 0; + intersectionval = 0; + while ( (firstidx < DV * M) && (secondidx < DV * M) ) { + if ( LSparse_loc[i][firstidx] == rotated_column[secondidx] ) { + intersectionval++; + firstidx++; + secondidx++; + } else if ( LSparse_loc[i][firstidx] > rotated_column[secondidx] ) { + secondidx++; + } else { /*if ( LSparse_loc[i][firstidx] < rotated_column[secondidx] ) */ + firstidx++; + } + } + gamma[i][j][k] = intersectionval; + + } + } + } + for (int i = 0; i < N0; i++ ) { + for (int j = 0; j < N0; j++ ) { + gamma[i][j][0] = 0; + } + } + /* build histogram of values in gamma */ + for (int i = 0; i < N0; i++ ) { + for (int j = 0; j < N0; j++ ) { + for (int k = 0; k < P; k++) { + gammaHist[i][gamma[i][j][k]]++; + } + } + } + + + for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { + toAdd = T_BAR - 1; + maxMutMinusOne[gammaBlockRowIdx] = 0; + histIdx = DV * M; + while ( (histIdx > 0) && (toAdd > 0)) { + if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { + maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; + toAdd = 0; + } else { + maxMutMinusOne[gammaBlockRowIdx] += histIdx * gammaHist[gammaBlockRowIdx][histIdx]; + toAdd -= gammaHist[gammaBlockRowIdx][histIdx]; + histIdx--; + } + } + maxMut[gammaBlockRowIdx] = histIdx + maxMutMinusOne[gammaBlockRowIdx]; + } + + + /*seek max values across all gamma blocks */ + allBlockMaxSumst = maxMut[0]; + allBlockMaxSumstMinusOne = maxMutMinusOne[0]; + for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { + allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? + maxMut[gammaBlockRowIdx] : + allBlockMaxSumst; + allBlockMaxSumstMinusOne = allBlockMaxSumstMinusOne < maxMutMinusOne[gammaBlockRowIdx] ? + maxMutMinusOne[gammaBlockRowIdx] : + allBlockMaxSumstMinusOne; + } + if (DV * M > (allBlockMaxSumstMinusOne + allBlockMaxSumst)) { + return (uint8_t) allBlockMaxSumst + 1; + } + return DFR_TEST_FAIL; +} diff --git a/crypto_kem/ledakemlt52/leaktime/dfr_test.h b/crypto_kem/ledakemlt52/leaktime/dfr_test.h new file mode 100644 index 00000000..92c49c75 --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/dfr_test.h @@ -0,0 +1,8 @@ +#ifndef DFR_TEST_H +#define DFR_TEST_H + +#define DFR_TEST_FAIL (255) + +uint8_t PQCLEAN_LEDAKEMLT52_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M]); + +#endif diff --git a/crypto_kem/ledakemlt52/leaktime/gf2x_arith.c b/crypto_kem/ledakemlt52/leaktime/gf2x_arith.c new file mode 100644 index 00000000..c90b2bc8 --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/gf2x_arith.c @@ -0,0 +1,73 @@ +#include "gf2x_arith.h" + +#include // memset(...) + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_add(DIGIT Res[], const DIGIT A[], const DIGIT B[], int nr) { + for (int i = 0; i < nr; i++) { + Res[i] = A[i] ^ B[i]; + } +} + +/* PRE: MAX ALLOWED ROTATION AMOUNT : DIGIT_SIZE_b */ +void PQCLEAN_LEDAKEMLT52_LEAKTIME_right_bit_shift_n(int length, DIGIT in[], unsigned int amount) { + if ( amount == 0 ) { + return; + } + unsigned int j; + DIGIT mask; + mask = ((DIGIT)0x01 << amount) - 1; + for (j = length - 1; j > 0 ; j--) { + in[j] >>= amount; + in[j] |= (in[j - 1] & mask) << (DIGIT_SIZE_b - amount); + } + in[j] >>= amount; +} + +/* PRE: MAX ALLOWED ROTATION AMOUNT : DIGIT_SIZE_b */ +void PQCLEAN_LEDAKEMLT52_LEAKTIME_left_bit_shift_n(int length, DIGIT in[], unsigned int amount) { + if ( amount == 0 ) { + return; + } + int j; + DIGIT mask; + mask = ~(((DIGIT)0x01 << (DIGIT_SIZE_b - amount)) - 1); + for (j = 0 ; j < length - 1 ; j++) { + in[j] <<= amount; + in[j] |= (in[j + 1] & mask) >> (DIGIT_SIZE_b - amount); + } + in[j] <<= amount; +} + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mul_comb(int nr, DIGIT Res[], + int na, const DIGIT A[], + int nb, const DIGIT B[]) { + int i, j, k; + DIGIT u, h; + + memset(Res, 0x00, nr * sizeof(DIGIT)); + + for (k = DIGIT_SIZE_b - 1; k > 0; k--) { + for (i = na - 1; i >= 0; i--) { + if ( A[i] & (((DIGIT)0x1) << k) ) { + for (j = nb - 1; j >= 0; j--) { + Res[i + j + 1] ^= B[j]; + } + } + } + + u = Res[na + nb - 1]; + Res[na + nb - 1] = u << 0x1; + for (j = 1; j < na + nb; ++j) { + h = u >> (DIGIT_SIZE_b - 1); + u = Res[na + nb - 1 - j]; + Res[na + nb - 1 - j] = h ^ (u << 0x1); + } + } + for (i = na - 1; i >= 0; i--) { + if ( A[i] & ((DIGIT)0x1) ) { + for (j = nb - 1; j >= 0; j--) { + Res[i + j + 1] ^= B[j]; + } + } + } +} diff --git a/crypto_kem/ledakemlt52/leaktime/gf2x_arith.h b/crypto_kem/ledakemlt52/leaktime/gf2x_arith.h new file mode 100644 index 00000000..c4635592 --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/gf2x_arith.h @@ -0,0 +1,58 @@ +#ifndef GF2X_ARITH_H +#define GF2X_ARITH_H + +#include +#include + +/* + * Elements of GF(2)[x] are stored in compact dense binary form. + * + * Each bit in a byte is assumed to be the coefficient of a binary + * polynomial f(x), in Big-Endian format (i.e., reading everything from + * left to right, the most significant element is met first): + * + * byte:(0000 0000) == 0x00 ... f(x) == 0 + * byte:(0000 0001) == 0x01 ... f(x) == 1 + * byte:(0000 0010) == 0x02 ... f(x) == x + * byte:(0000 0011) == 0x03 ... f(x) == x+1 + * ... ... ... + * byte:(0000 1111) == 0x0F ... f(x) == x^{3}+x^{2}+x+1 + * ... ... ... + * byte:(1111 1111) == 0xFF ... f(x) == x^{7}+x^{6}+x^{5}+x^{4}+x^{3}+x^{2}+x+1 + * + * + * A "machine word" (A_i) is considered as a DIGIT. + * Bytes in a DIGIT are assumed in Big-Endian format: + * E.g., if sizeof(DIGIT) == 4: + * A_i: A_{i,3} A_{i,2} A_{i,1} A_{i,0}. + * A_{i,3} denotes the most significant byte, A_{i,0} the least significant one. + * f(x) == x^{31} + ... + x^{24} + + * + x^{23} + ... + x^{16} + + * + x^{15} + ... + x^{8} + + * + x^{7} + ... + x^{0} + * + * + * Multi-precision elements (i.e., with multiple DIGITs) are stored in + * Big-endian format: + * A = A_{n-1} A_{n-2} ... A_1 A_0 + * + * position[A_{n-1}] == 0 + * position[A_{n-2}] == 1 + * ... + * position[A_{1}] == n-2 + * position[A_{0}] == n-1 + */ + +typedef uint64_t DIGIT; +#define DIGIT_SIZE_B (8) +#define DIGIT_SIZE_b (DIGIT_SIZE_B << 3) +#define POSITION_T uint32_t + +#define GF2X_MUL PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mul_comb + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_add(DIGIT Res[], const DIGIT A[], const DIGIT B[], int nr); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_right_bit_shift_n(int length, DIGIT in[], unsigned int amount); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_left_bit_shift_n(int length, DIGIT in[], unsigned int amount); +void GF2X_MUL(int nr, DIGIT Res[], int na, const DIGIT A[], int nb, const DIGIT B[]); + +#endif diff --git a/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.c b/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.c new file mode 100644 index 00000000..389e23f6 --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.c @@ -0,0 +1,581 @@ +#include "gf2x_arith_mod_xPplusOne.h" +#include "rng.h" + +#include // memcpy(...), memset(...) + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { + for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { + dest[i] = in[i]; + } +} + +/* returns the coefficient of the x^exponent term as the LSB of a digit */ +DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) { + unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; + unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; + return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; +} + +/* sets the coefficient of the x^exponent term as the LSB of a digit */ +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) { + unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; + unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; + + /* clear given coefficient */ + DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + poly[digitIdx] = poly[digitIdx] & mask; + poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); +} + +/* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) { + unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; + unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; + unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; + + /* clear given coefficient */ + DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); + poly[digitIdx] = poly[digitIdx] ^ mask; +} + +/* population count for an unsigned 64-bit integer + Source: Hacker's delight, p.66 */ +static int popcount_uint64t(uint64_t x) { + x -= (x >> 1) & 0x5555555555555555; + x = (x & 0x3333333333333333) + ((x >> 2) & 0x3333333333333333); + x = (x + (x >> 4)) & 0x0f0f0f0f0f0f0f0f; + return (int)((x * 0x0101010101010101) >> 56); +} + +/* population count for a single polynomial */ +int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(DIGIT *poly) { + int ret = 0; + for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { + ret += popcount_uint64t(poly[i]); + } + return ret; +} + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_add(Res, A, B, NUM_DIGITS_GF2X_ELEMENT); +} + +static int partition(POSITION_T arr[], int lo, int hi) { + POSITION_T x = arr[hi]; + POSITION_T tmp; + int i = (lo - 1); + for (int j = lo; j <= hi - 1; j++) { + if (arr[j] <= x) { + i++; + tmp = arr[i]; + arr[i] = arr[j]; + arr[j] = tmp; + } + } + tmp = arr[i + 1]; + arr[i + 1] = arr[hi]; + arr[hi] = tmp; + + return i + 1; +} + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_quicksort_sparse(POSITION_T Res[]) { + int stack[DV * M]; + int hi, lo, pivot, tos = -1; + stack[++tos] = 0; + stack[++tos] = (DV * M) - 1; + while (tos >= 0 ) { + hi = stack[tos--]; + lo = stack[tos--]; + pivot = partition(Res, lo, hi); + if ( (pivot - 1) > lo) { + stack[++tos] = lo; + stack[++tos] = pivot - 1; + } + if ( (pivot + 1) < hi) { + stack[++tos] = pivot + 1; + stack[++tos] = hi; + } + } +} + +static void gf2x_mod(DIGIT out[], const DIGIT in[]) { + + int i, j, posTrailingBit, maskOffset; + DIGIT mask, aux[2 * NUM_DIGITS_GF2X_ELEMENT]; + + memcpy(aux, in, 2 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + memset(out, 0x00, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + + for (i = 0; i < (2 * NUM_DIGITS_GF2X_ELEMENT) - NUM_DIGITS_GF2X_MODULUS; i += 1) { + for (j = DIGIT_SIZE_b - 1; j >= 0; j--) { + mask = ((DIGIT)0x1) << j; + if (aux[i] & mask) { + aux[i] ^= mask; + posTrailingBit = (DIGIT_SIZE_b - 1 - j) + i * DIGIT_SIZE_b + P; + maskOffset = (DIGIT_SIZE_b - 1 - (posTrailingBit % DIGIT_SIZE_b)); + mask = (DIGIT) 0x1 << maskOffset; + aux[posTrailingBit / DIGIT_SIZE_b] ^= mask; + } + } + } + + for (j = DIGIT_SIZE_b - 1; j >= MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS; j--) { + mask = ((DIGIT)0x1) << j; + if (aux[i] & mask) { + aux[i] ^= mask; + posTrailingBit = (DIGIT_SIZE_b - 1 - j) + i * DIGIT_SIZE_b + P; + maskOffset = (DIGIT_SIZE_b - 1 - (posTrailingBit % DIGIT_SIZE_b)); + mask = (DIGIT) 0x1 << maskOffset; + aux[posTrailingBit / DIGIT_SIZE_b] ^= mask; + } + } + + for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + out[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = aux[2 * NUM_DIGITS_GF2X_ELEMENT - 1 - i]; + } + +} + +static void left_bit_shift(const int length, DIGIT in[]) { + + int j; + for (j = 0; j < length - 1; j++) { + in[j] <<= 1; /* logical shift does not need clearing */ + in[j] |= in[j + 1] >> (DIGIT_SIZE_b - 1); + } + in[j] <<= 1; +} + +static void right_bit_shift(unsigned int length, DIGIT in[]) { + + unsigned int j; + for (j = length - 1; j > 0 ; j--) { + in[j] >>= 1; + in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); + } + in[j] >>= 1; +} + + +/* shifts by whole digits */ +static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) { + unsigned int j; + for (j = 0; (j + amount) < length; j++) { + in[j] = in[j + amount]; + } + for (; j < length; j++) { + in[j] = (DIGIT)0; + } +} + +/* may shift by an arbitrary amount*/ +static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) { + left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); + PQCLEAN_LEDAKEMLT52_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); +} + +/* Hackers delight, reverses a uint64_t */ +static DIGIT reverse_digit(DIGIT x) { + uint64_t t; + x = (x << 31) | (x >> 33); + t = (x ^ (x >> 20)) & 0x00000FFF800007FFLL; + x = (t | (t << 20)) ^ x; + t = (x ^ (x >> 8)) & 0x00F8000F80700807LL; + x = (t | (t << 8)) ^ x; + t = (x ^ (x >> 4)) & 0x0808708080807008LL; + x = (t | (t << 4)) ^ x; + t = (x ^ (x >> 2)) & 0x1111111111111111LL; + x = (t | (t << 2)) ^ x; + return x; +} + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) { + /* it keeps the lsb in the same position and + * inverts the sequence of the remaining bits */ + + DIGIT mask = (DIGIT)0x1; + DIGIT rev1, rev2, a00; + int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; + + a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; + right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); + + for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { + rev1 = reverse_digit(A[i]); + rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); + A[i] = rev2; + A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; + } + + if (slack_bits_amount) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); + } + A[NUM_DIGITS_GF2X_ELEMENT - 1] = (A[NUM_DIGITS_GF2X_ELEMENT - 1] & (~mask)) | a00; +} + +static void rotate_bit_left(DIGIT in[]) { /* equivalent to x * in(x) mod x^P+1 */ + + DIGIT mask, rotated_bit; + int msb_offset_in_digit = MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS - 1; + mask = ((DIGIT)0x1) << msb_offset_in_digit; + rotated_bit = !!(in[0] & mask); + in[0] &= ~mask; + left_bit_shift(NUM_DIGITS_GF2X_ELEMENT, in); + in[NUM_DIGITS_GF2X_ELEMENT - 1] |= rotated_bit; +} + +static void rotate_bit_right(DIGIT in[]) { /* x^{-1} * in(x) mod x^P+1 */ + + DIGIT rotated_bit = in[NUM_DIGITS_GF2X_ELEMENT - 1] & ((DIGIT)0x1); + right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, in); + int msb_offset_in_digit = MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS - 1; + rotated_bit = rotated_bit << msb_offset_in_digit; + in[0] |= rotated_bit; +} + +static void gf2x_swap(const int length, DIGIT f[], DIGIT s[]) { + DIGIT t; + for (int i = length - 1; i >= 0; i--) { + t = f[i]; + f[i] = s[i]; + s[i] = t; + } +} + +/* + * Optimized extended GCD algorithm to compute the multiplicative inverse of + * a non-zero element in GF(2)[x] mod x^P+1, in polyn. representation. + * + * H. Brunner, A. Curiger, and M. Hofstetter. 1993. + * On Computing Multiplicative Inverses in GF(2^m). + * IEEE Trans. Comput. 42, 8 (August 1993), 1010-1015. + * DOI=http://dx.doi.org/10.1109/12.238496 + * + * + * Henri Cohen, Gerhard Frey, Roberto Avanzi, Christophe Doche, Tanja Lange, + * Kim Nguyen, and Frederik Vercauteren. 2012. + * Handbook of Elliptic and Hyperelliptic Curve Cryptography, + * Second Edition (2nd ed.). Chapman & Hall/CRC. + * (Chapter 11 -- Algorithm 11.44 -- pag 223) + * + */ +int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { /* in^{-1} mod x^P-1 */ + + int i; + int delta = 0; + DIGIT u[NUM_DIGITS_GF2X_ELEMENT] = {0}; + DIGIT v[NUM_DIGITS_GF2X_ELEMENT] = {0}; + DIGIT s[NUM_DIGITS_GF2X_MODULUS] = {0}; + DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // alignas(32)? + + DIGIT mask; + u[NUM_DIGITS_GF2X_ELEMENT - 1] = 0x1; + v[NUM_DIGITS_GF2X_ELEMENT - 1] = 0x0; + + s[NUM_DIGITS_GF2X_MODULUS - 1] = 0x1; + + mask = (((DIGIT)0x1) << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); + s[0] |= mask; + + for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0 && in[i] == 0; i--) { }; + if (i < 0) { + return 0; + } + + for (i = NUM_DIGITS_GF2X_MODULUS - 1; i >= 0 ; i--) { + f[i] = in[i]; + } + + for (i = 1; i <= 2 * P; i++) { + if ( (f[0] & mask) == 0 ) { + left_bit_shift(NUM_DIGITS_GF2X_MODULUS, f); + rotate_bit_left(u); + delta += 1; + } else { + if ( (s[0] & mask) != 0) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_add(s, s, f, NUM_DIGITS_GF2X_MODULUS); + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add(v, v, u); + } + left_bit_shift(NUM_DIGITS_GF2X_MODULUS, s); + if ( delta == 0 ) { + gf2x_swap(NUM_DIGITS_GF2X_MODULUS, f, s); + gf2x_swap(NUM_DIGITS_GF2X_ELEMENT, u, v); + rotate_bit_left(u); + delta = 1; + } else { + rotate_bit_right(u); + delta = delta - 1; + } + } + } + + for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0 ; i--) { + out[i] = u[i]; + } + + return (delta == 0); +} + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]) { + + DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT]; + GF2X_MUL(2 * NUM_DIGITS_GF2X_ELEMENT, aux, + NUM_DIGITS_GF2X_ELEMENT, A, + NUM_DIGITS_GF2X_ELEMENT, B); + gf2x_mod(Res, aux); + +} + +/*PRE: the representation of the sparse coefficients is sorted in increasing + order of the coefficients themselves */ +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse( + DIGIT Res[], + const DIGIT dense[], + POSITION_T sparse[], unsigned int nPos) { + + DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; + DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; + memcpy(aux + NUM_DIGITS_GF2X_ELEMENT, dense, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + memcpy(resDouble + NUM_DIGITS_GF2X_ELEMENT, dense, + NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + + if (sparse[0] != INVALID_POS_VALUE) { + left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); + left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); + + for (unsigned int i = 1; i < nPos; i++) { + if (sparse[i] != INVALID_POS_VALUE) { + left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); + } + } + } + + gf2x_mod(Res, resDouble); + +} + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) { + + POSITION_T t; + int i = 0, j; + + if (A[i] == 0) { + i = 1; + } + j = i; + + for (; i < sizeA && A[i] != INVALID_POS_VALUE; i++) { + A[i] = P - A[i]; + } + + for (i -= 1; j < i; j++, i--) { + t = A[j]; + A[j] = A[i]; + A[i] = t; + } + +} + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], + size_t sizeA, const POSITION_T A[], + size_t sizeB, const POSITION_T B[]) { + + /* compute all the coefficients, filling invalid positions with P*/ + size_t lastFilledPos = 0; + for (size_t i = 0 ; i < sizeA ; i++) { + for (size_t j = 0 ; j < sizeB ; j++) { + uint32_t prod = A[i] + B[j]; + prod = ( (prod >= P) ? prod - P : prod); + if ((A[i] != INVALID_POS_VALUE) && + (B[j] != INVALID_POS_VALUE)) { + Res[lastFilledPos] = prod; + } else { + Res[lastFilledPos] = INVALID_POS_VALUE; + } + lastFilledPos++; + } + } + while (lastFilledPos < sizeR) { + Res[lastFilledPos] = INVALID_POS_VALUE; + lastFilledPos++; + } + PQCLEAN_LEDAKEMLT52_LEAKTIME_quicksort_sparse(Res); + /* eliminate duplicates */ + POSITION_T lastReadPos = Res[0]; + int duplicateCount; + size_t write_idx = 0; + size_t read_idx = 0; + while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { + lastReadPos = Res[read_idx]; + read_idx++; + duplicateCount = 1; + while ( (Res[read_idx] == lastReadPos) && (Res[read_idx] != INVALID_POS_VALUE)) { + read_idx++; + duplicateCount++; + } + if (duplicateCount % 2) { + Res[write_idx] = lastReadPos; + write_idx++; + } + } + /* fill remaining cells with INVALID_POS_VALUE */ + for (; write_idx < sizeR; write_idx++) { + Res[write_idx] = INVALID_POS_VALUE; + } +} + +/* the implementation is safe even in case A or B alias with the result + * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse( + int sizeR, POSITION_T Res[], + int sizeA, const POSITION_T A[], + int sizeB, const POSITION_T B[]) { + + POSITION_T tmpRes[DV * M]; + int idxA = 0, idxB = 0, idxR = 0; + while ( idxA < sizeA && + idxB < sizeB && + A[idxA] != INVALID_POS_VALUE && + B[idxB] != INVALID_POS_VALUE ) { + + if (A[idxA] == B[idxB]) { + idxA++; + idxB++; + } else { + if (A[idxA] < B[idxB]) { + tmpRes[idxR] = A[idxA]; + idxA++; + } else { + tmpRes[idxR] = B[idxB]; + idxB++; + } + idxR++; + } + } + + while (idxA < sizeA && A[idxA] != INVALID_POS_VALUE) { + tmpRes[idxR] = A[idxA]; + idxA++; + idxR++; + } + + while (idxB < sizeB && B[idxB] != INVALID_POS_VALUE) { + tmpRes[idxR] = B[idxB]; + idxB++; + idxR++; + } + + while (idxR < sizeR) { + tmpRes[idxR] = INVALID_POS_VALUE; + idxR++; + } + memcpy(Res, tmpRes, sizeof(POSITION_T)*sizeR); + +} + +/* Return a uniform random value in the range 0..n-1 inclusive, + * applying a rejection sampling strategy and exploiting as a random source + * the NIST seedexpander seeded with the proper key. + * Assumes that the maximum value for the range n is 2^32-1 + */ +static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct *seed_expander_ctx) { + unsigned long required_rnd_bytes = (logn + 7) / 8; + unsigned char rnd_char_buffer[4]; + uint32_t rnd_value; + uint32_t mask = ( (uint32_t)1 << logn) - 1; + + do { + PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(seed_expander_ctx, rnd_char_buffer, required_rnd_bytes); + /* obtain an endianness independent representation of the generated random + bytes into an unsigned integer */ + rnd_value = ((uint32_t)rnd_char_buffer[3] << 24) + + ((uint32_t)rnd_char_buffer[2] << 16) + + ((uint32_t)rnd_char_buffer[1] << 8) + + ((uint32_t)rnd_char_buffer[0] << 0) ; + rnd_value = mask & rnd_value; + } while (rnd_value >= n); + + return rnd_value; +} + +/* Obtains fresh randomness and seed-expands it until all the required positions + * for the '1's in the circulant block are obtained */ +void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, + int countOnes, + AES_XOF_struct *seed_expander_ctx) { + + int duplicated, placedOnes = 0; + uint32_t p; + + while (placedOnes < countOnes) { + p = rand_range(NUM_BITS_GF2X_ELEMENT, + P_BITS, + seed_expander_ctx); + duplicated = 0; + for (int j = 0; j < placedOnes; j++) { + if (pos_ones[j] == p) { + duplicated = 1; + } + } + if (duplicated == 0) { + pos_ones[placedOnes] = p; + placedOnes++; + } + } +} + +/* Returns random weight-t circulant block */ +void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_blocks_sequence( + DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], + AES_XOF_struct *seed_expander_ctx) { + + int rndPos[NUM_ERRORS_T], duplicated, counter = 0; + int p, polyIndex, exponent; + + memset(sequence, 0x00, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + + while (counter < NUM_ERRORS_T) { + p = rand_range(N0 * NUM_BITS_GF2X_ELEMENT, P_BITS, + seed_expander_ctx); + duplicated = 0; + for (int j = 0; j < counter; j++) { + if (rndPos[j] == p) { + duplicated = 1; + } + } + if (duplicated == 0) { + rndPos[counter] = p; + counter++; + } + } + for (int j = 0; j < counter; j++) { + polyIndex = rndPos[j] / P; + exponent = rndPos[j] % P; + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff( sequence + NUM_DIGITS_GF2X_ELEMENT * polyIndex, exponent, + ( (DIGIT) 1)); + } + +} + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly) { + size_t i, j; + for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + for (j = 0; j < DIGIT_SIZE_B; j++) { + bytes[i * DIGIT_SIZE_B + j] = (uint8_t) (poly[i] >> 8 * j); + } + } +} + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes) { + size_t i, j; + for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + poly[i] = (DIGIT) 0; + for (j = 0; j < DIGIT_SIZE_B; j++) { + poly[i] |= (DIGIT) poly_bytes[i * DIGIT_SIZE_B + j] << 8 * j; + } + } +} diff --git a/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.h b/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.h new file mode 100644 index 00000000..2286c55f --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.h @@ -0,0 +1,37 @@ +#ifndef GF2X_ARITH_MOD_XPLUSONE_H +#define GF2X_ARITH_MOD_XPLUSONE_H + +#include "qc_ldpc_parameters.h" + +#include "gf2x_arith.h" +#include "rng.h" + +#define NUM_BITS_GF2X_ELEMENT (P) // 152267 +#define NUM_DIGITS_GF2X_ELEMENT ((P+DIGIT_SIZE_b-1)/DIGIT_SIZE_b) // 2380 +#define MSb_POSITION_IN_MSB_DIGIT_OF_ELEMENT ((P % DIGIT_SIZE_b) ? (P % DIGIT_SIZE_b)-1 : DIGIT_SIZE_b-1) +#define NUM_BITS_GF2X_MODULUS (P+1) +#define NUM_DIGITS_GF2X_MODULUS ((P+1+DIGIT_SIZE_b-1)/DIGIT_SIZE_b) // 2380 +#define MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS (P-DIGIT_SIZE_b*(NUM_DIGITS_GF2X_MODULUS-1)) +#define INVALID_POS_VALUE (P) +#define P_BITS (18) // log_2(p) = 17.216243783 + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); +DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent); +int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(DIGIT *poly); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_quicksort_sparse(POSITION_T Res[]); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]); +int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); + +#endif diff --git a/crypto_kem/ledakemlt52/leaktime/kem.c b/crypto_kem/ledakemlt52/leaktime/kem.c new file mode 100644 index 00000000..316d14d0 --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/kem.c @@ -0,0 +1,92 @@ +#include "api.h" +#include "niederreiter.h" +#include "randombytes.h" +#include "rng.h" + +#include + +static void pack_pk(uint8_t *pk_bytes, publicKeyNiederreiter_t *pk) { + size_t i; + for (i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_tobytes(pk_bytes + i * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B, + pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); + } +} + +static void unpack_pk(publicKeyNiederreiter_t *pk, const uint8_t *pk_bytes) { + size_t i; + for (i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_frombytes(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, + pk_bytes + i * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + } +} + +static void pack_ct(uint8_t *sk_bytes, DIGIT *ct) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_tobytes(sk_bytes, ct); +} + +static void unpack_ct(DIGIT *ct, const uint8_t *ct_bytes) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_frombytes(ct, ct_bytes); +} + +static void pack_error(uint8_t *error_bytes, DIGIT *error_digits) { + size_t i; + for (i = 0; i < N0; i++) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_tobytes(error_bytes + i * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B, + error_digits + i * NUM_DIGITS_GF2X_ELEMENT); + } +} + +/* Generates a keypair - pk is the public key and sk is the secret key. */ +int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_keypair(unsigned char *pk, unsigned char *sk) { + AES_XOF_struct niederreiter_keys_expander; + publicKeyNiederreiter_t pk_nie; + + randombytes(((privateKeyNiederreiter_t *)sk)->prng_seed, TRNG_BYTE_LENGTH); + PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(&niederreiter_keys_expander, ((privateKeyNiederreiter_t *)sk)->prng_seed); + PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_keygen(&pk_nie, (privateKeyNiederreiter_t *) sk, &niederreiter_keys_expander); + + pack_pk(pk, &pk_nie); + + return 0; +} + +/* Encrypt - pk is the public key, ct is a key encapsulation message + (ciphertext), ss is the shared secret.*/ +int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk) { + AES_XOF_struct niederreiter_encap_key_expander; + unsigned char encapsulated_key_seed[TRNG_BYTE_LENGTH]; + DIGIT error_vector[N0 * NUM_DIGITS_GF2X_ELEMENT]; + uint8_t error_bytes[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; + DIGIT syndrome[NUM_DIGITS_GF2X_ELEMENT]; + publicKeyNiederreiter_t pk_nie; + + randombytes(encapsulated_key_seed, TRNG_BYTE_LENGTH); + unpack_pk(&pk_nie, pk); + + PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(&niederreiter_encap_key_expander, encapsulated_key_seed); + PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_blocks_sequence(error_vector, &niederreiter_encap_key_expander); + pack_error(error_bytes, error_vector); + HASH_FUNCTION(ss, error_bytes, (N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B)); + PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_encrypt(syndrome, &pk_nie, error_vector); + + pack_ct(ct, syndrome); + + return 0; +} + + +/* Decrypt - ct is a key encapsulation message (ciphertext), sk is the private + key, ss is the shared secret */ +int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk) { + DIGIT decoded_error_vector[N0 * NUM_DIGITS_GF2X_ELEMENT]; + uint8_t decoded_error_bytes[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; + DIGIT syndrome[NUM_DIGITS_GF2X_ELEMENT]; + + unpack_ct(syndrome, ct); + PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(decoded_error_vector, (privateKeyNiederreiter_t *)sk, syndrome); + pack_error(decoded_error_bytes, decoded_error_vector); + HASH_FUNCTION(ss, decoded_error_bytes, (N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B)); + + return 0; +} diff --git a/crypto_kem/ledakemlt52/leaktime/niederreiter.c b/crypto_kem/ledakemlt52/leaktime/niederreiter.c new file mode 100644 index 00000000..d8a70262 --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/niederreiter.c @@ -0,0 +1,192 @@ +#include "H_Q_matrices_generation.h" +#include "bf_decoding.h" +#include "dfr_test.h" +#include "gf2x_arith_mod_xPplusOne.h" +#include "niederreiter.h" +#include "qc_ldpc_parameters.h" +#include "rng.h" + +#include + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *pk, privateKeyNiederreiter_t *sk, AES_XOF_struct *keys_expander) { + + POSITION_T HPosOnes[N0][DV]; // sequence of N0 circ block matrices (p x p): Hi + POSITION_T HtrPosOnes[N0][DV]; // Sparse tranposed circulant H + POSITION_T QPosOnes[N0][M]; // Sparse Q, Each row contains the position of the ones of all the blocks of a row of Q as exponent+P*block_position + POSITION_T LPosOnes[N0][DV * M]; + POSITION_T auxPosOnes[DV * M]; + unsigned char processedQOnes[N0]; + DIGIT Ln0dense[NUM_DIGITS_GF2X_ELEMENT]; + DIGIT Ln0Inv[NUM_DIGITS_GF2X_ELEMENT]; + int is_L_full = 0; + uint8_t threshold = (DV * M) / 2 + 1; // threshold for round 2 + sk->rejections = (int8_t) 0; + + do { + PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes_HtrPosOnes(HPosOnes, HtrPosOnes, keys_expander); + PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQsparse(QPosOnes, keys_expander); + for (int i = 0; i < N0; i++) { + for (int j = 0; j < DV * M; j++) { + LPosOnes[i][j] = INVALID_POS_VALUE; + } + } + + memset(processedQOnes, 0x00, sizeof(processedQOnes)); + for (int colQ = 0; colQ < N0; colQ++) { + for (int i = 0; i < N0; i++) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, + DV, HPosOnes[i], + qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(DV * M, LPosOnes[colQ], + DV * M, LPosOnes[colQ], + DV * M, auxPosOnes); + processedQOnes[i] += qBlockWeights[i][colQ]; + } + } + is_L_full = 1; + for (int i = 0; i < N0; i++) { + is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); + } + sk->rejections = sk->rejections + 1; + if (is_L_full) { + threshold = PQCLEAN_LEDAKEMLT52_LEAKTIME_DFR_test(LPosOnes); + } + } while (!is_L_full || threshold == DFR_TEST_FAIL); + sk->rejections = sk->rejections - 1; + sk->threshold = threshold; + + memset(Ln0dense, 0x00, sizeof(Ln0dense)); + for (int j = 0; j < DV * M; j++) { + if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); + } + } + + memset(Ln0Inv, 0x00, sizeof(Ln0Inv)); + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); + for (int i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, + Ln0Inv, + LPosOnes[i], + DV * M); + } + + for (int i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); + } +} + + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_encrypt(DIGIT *syndrome, const publicKeyNiederreiter_t *pk, const DIGIT *err) { + int i; + DIGIT saux[NUM_DIGITS_GF2X_ELEMENT]; + + memset(syndrome, 0x00, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + for (i = 0; i < N0 - 1; i++) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul(saux, + pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, + err + i * NUM_DIGITS_GF2X_ELEMENT); + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add(syndrome, syndrome, saux); + } + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add(syndrome, syndrome, err + (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT); +} + + +int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateKeyNiederreiter_t *sk, const DIGIT *syndrome) { + AES_XOF_struct niederreiter_decrypt_expander; + POSITION_T HPosOnes[N0][DV]; + POSITION_T HtrPosOnes[N0][DV]; + POSITION_T QPosOnes[N0][M]; + POSITION_T QtrPosOnes[N0][M]; + POSITION_T auxPosOnes[DV * M]; + POSITION_T LPosOnes[N0][DV * M]; + POSITION_T auxSparse[DV * M]; + POSITION_T Ln0trSparse[DV * M]; + unsigned char processedQOnes[N0]; + unsigned transposed_ones_idx[N0]; + DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; + DIGIT mockup_error_vector[N0 * NUM_DIGITS_GF2X_ELEMENT]; + int rejections = sk->rejections; + int currQoneIdx, endQblockIdx; + int decryptOk, err_weight; + + PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); + + do { + PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes_HtrPosOnes(HPosOnes, HtrPosOnes, &niederreiter_decrypt_expander); + PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQsparse(QPosOnes, &niederreiter_decrypt_expander); + for (int i = 0; i < N0; i++) { + for (int j = 0; j < DV * M; j++) { + LPosOnes[i][j] = INVALID_POS_VALUE; + } + } + + memset(processedQOnes, 0x00, sizeof(processedQOnes)); + for (int colQ = 0; colQ < N0; colQ++) { + for (int i = 0; i < N0; i++) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, + DV, HPosOnes[i], + qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(DV * M, LPosOnes[colQ], + DV * M, LPosOnes[colQ], + DV * M, auxPosOnes); + processedQOnes[i] += qBlockWeights[i][colQ]; + } + } + rejections--; + } while (rejections >= 0); + + memset(transposed_ones_idx, 0x00, sizeof(transposed_ones_idx)); + for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { + currQoneIdx = 0; // position in the column of QtrPosOnes[][...] + endQblockIdx = 0; + for (int blockIdx = 0; blockIdx < N0; blockIdx++) { + endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; + for (; currQoneIdx < endQblockIdx; currQoneIdx++) { + QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P - + QPosOnes[source_row_idx][currQoneIdx]) % P; + transposed_ones_idx[blockIdx]++; + } + } + } + + for (int i = 0; i < DV * M; i++) { + Ln0trSparse[i] = INVALID_POS_VALUE; + auxSparse[i] = INVALID_POS_VALUE; + } + + for (int i = 0; i < N0; i++) { + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, + DV, HPosOnes[i], + qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1]]); + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, + DV * M, Ln0trSparse, + DV * M, auxSparse); + } + + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(DV * M, Ln0trSparse); + PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(privateSyndrome, syndrome, Ln0trSparse, DV * M); + + /* prepare mockup error vector in case a decoding failure occurs */ + memset(mockup_error_vector, 0x00, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + memcpy(mockup_error_vector, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(&niederreiter_decrypt_expander, + ((unsigned char *) mockup_error_vector) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B), + TRNG_BYTE_LENGTH); + + memset(err, 0x00, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + decryptOk = PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(err, (const POSITION_T (*)[DV]) HtrPosOnes, + (const POSITION_T (*)[M]) QtrPosOnes, privateSyndrome, sk->threshold); + + err_weight = 0; + for (int i = 0 ; i < N0; i++) { + err_weight += PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(err + (NUM_DIGITS_GF2X_ELEMENT * i)); + } + decryptOk = decryptOk && (err_weight == NUM_ERRORS_T); + + if (!decryptOk) { // TODO: not constant time, replace with cmov? + memcpy(err, mockup_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); + } + + return decryptOk; +} diff --git a/crypto_kem/ledakemlt52/leaktime/niederreiter.h b/crypto_kem/ledakemlt52/leaktime/niederreiter.h new file mode 100644 index 00000000..a74e3169 --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/niederreiter.h @@ -0,0 +1,29 @@ +#ifndef NIEDERREITER_H +#define NIEDERREITER_H + +#include "gf2x_arith_mod_xPplusOne.h" +#include "qc_ldpc_parameters.h" +#include "rng.h" + +typedef struct { + /* raw entropy extracted from TRNG, will be deterministically expanded into + * H and Q during decryption */ + unsigned char prng_seed[TRNG_BYTE_LENGTH]; + int8_t rejections; + uint8_t threshold; // for round 2 +} privateKeyNiederreiter_t; + +typedef struct { + DIGIT Mtr[(N0 - 1)*NUM_DIGITS_GF2X_ELEMENT]; + // Dense representation of the matrix M=Ln0*L, + // An array including a sequence of (N0-1) gf2x elements; + // each gf2x element is stored as a binary polynomial(mod x^P+1) + // with P coefficients. +} publicKeyNiederreiter_t; + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *pk, privateKeyNiederreiter_t *sk, AES_XOF_struct *keys_expander); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_encrypt(DIGIT syndrome[], const publicKeyNiederreiter_t *pk, const DIGIT *err); +int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateKeyNiederreiter_t *sk, const DIGIT *syndrome); + + +#endif diff --git a/crypto_kem/ledakemlt52/leaktime/qc_ldpc_parameters.h b/crypto_kem/ledakemlt52/leaktime/qc_ldpc_parameters.h new file mode 100644 index 00000000..fbb3e722 --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/qc_ldpc_parameters.h @@ -0,0 +1,27 @@ +#ifndef QC_LDPC_PARAMETERS_H +#define QC_LDPC_PARAMETERS_H + +#include "fips202.h" + +#define TRNG_BYTE_LENGTH (40) +#define HASH_BYTE_LENGTH (64) +#define HASH_FUNCTION sha3_512 + +#define N0 (2) +#define P (152267) // modulus(x) = x^P-1 +#define DV (13) // odd number +#define M (13) +#define M0 (7) +#define M1 (6) +#define NUM_ERRORS_T (267) + +// Derived parameters, they are useful for QC-LDPC algorithms +#define HASH_BIT_LENGTH (HASH_BYTE_LENGTH << 3) +#define K ((N0-1)*P) +#define N (N0*P) +#define DC (N0*DV) + +#define Q_BLOCK_WEIGHTS {{M0,M1},{M1,M0}} +static const unsigned char qBlockWeights[N0][N0] = Q_BLOCK_WEIGHTS; + +#endif diff --git a/crypto_kem/ledakemlt52/leaktime/rng.c b/crypto_kem/ledakemlt52/leaktime/rng.c new file mode 100644 index 00000000..b9f6c255 --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/rng.c @@ -0,0 +1,108 @@ +#include "rng.h" + +#include // void *memset(void *s, int c, size_t n); + +#include "aes.h" +#include "qc_ldpc_parameters.h" + +/* + seedexpander_init() + ctx - stores the current state of an instance of the seed expander + seed - a 32 byte random value + diversifier - an 8 byte diversifier + maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier + */ +static void seedexpander_init(AES_XOF_struct *ctx, + unsigned char *seed, + unsigned char *diversifier, + size_t maxlen) { + + ctx->length_remaining = maxlen; + + memset(ctx->key, 0, 32); + int max_accessible_seed_len = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; + memcpy(ctx->key, seed, max_accessible_seed_len); + + memcpy(ctx->ctr, diversifier, 8); + ctx->ctr[11] = maxlen % 256; + maxlen >>= 8; + ctx->ctr[10] = maxlen % 256; + maxlen >>= 8; + ctx->ctr[9] = maxlen % 256; + maxlen >>= 8; + ctx->ctr[8] = maxlen % 256; + memset(ctx->ctr + 12, 0x00, 4); + + ctx->buffer_pos = 16; + memset(ctx->buffer, 0x00, 16); +} + +void PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, + const unsigned char *trng_entropy + /* TRNG_BYTE_LENGTH wide buffer */) { + + /*the NIST seedexpander will however access 32B from this buffer */ + unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; + unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 }; + unsigned char *diversifier = ((unsigned char *)trng_entropy) + 32; + + memcpy(prng_buffer, + trng_entropy, + TRNG_BYTE_LENGTH < prng_buffer_size ? TRNG_BYTE_LENGTH : prng_buffer_size); + + /* the required seed expansion will be quite small, set the max number of + * bytes conservatively to 10 MiB*/ + seedexpander_init(ctx, prng_buffer, diversifier, RNG_MAXLEN); +} + +/* + seedexpander() + ctx - stores the current state of an instance of the seed expander + x - returns the XOF data + xlen - number of bytes to return + */ +int PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) { + size_t offset; + aes256ctx ctx256; + + if ( x == NULL ) { + return RNG_BAD_OUTBUF; + } + if ( xlen >= ctx->length_remaining ) { + return RNG_BAD_REQ_LEN; + } + + aes256_keyexp(&ctx256, ctx->key); + ctx->length_remaining -= xlen; + + offset = 0; + while ( xlen > 0 ) { + if ( xlen <= (16 - ctx->buffer_pos) ) { // buffer has what we need + memcpy(x + offset, ctx->buffer + ctx->buffer_pos, xlen); + ctx->buffer_pos += xlen; + + return RNG_SUCCESS; + } + + // take what's in the buffer + memcpy(x + offset, ctx->buffer + ctx->buffer_pos, 16 - ctx->buffer_pos); + xlen -= 16 - ctx->buffer_pos; + offset += 16 - ctx->buffer_pos; + + aes256_ecb(ctx->buffer, ctx->ctr, 16 / AES_BLOCKBYTES, &ctx256); + ctx->buffer_pos = 0; + + //increment the counter + for (int i = 15; i >= 12; i--) { + if ( ctx->ctr[i] == 0xff ) { + ctx->ctr[i] = 0x00; + } else { + ctx->ctr[i]++; + break; + } + } + + } + + return RNG_SUCCESS; +} diff --git a/crypto_kem/ledakemlt52/leaktime/rng.h b/crypto_kem/ledakemlt52/leaktime/rng.h new file mode 100644 index 00000000..19470c36 --- /dev/null +++ b/crypto_kem/ledakemlt52/leaktime/rng.h @@ -0,0 +1,24 @@ +#ifndef RNG_H +#define RNG_H + +#include +#include + +#define RNG_SUCCESS ( 0) +#define RNG_BAD_MAXLEN (-1) +#define RNG_BAD_OUTBUF (-2) +#define RNG_BAD_REQ_LEN (-3) +#define RNG_MAXLEN (10 * 1024 * 1024) + +typedef struct { + unsigned char buffer[16]; + size_t buffer_pos; + size_t length_remaining; + unsigned char key[32]; + unsigned char ctr[16]; +} AES_XOF_struct; + +int PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen); +void PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, const unsigned char *trng_entropy); + +#endif diff --git a/test/duplicate_consistency/ledakemlt12_leaktime.yml b/test/duplicate_consistency/ledakemlt12_leaktime.yml new file mode 100644 index 00000000..e85f05ab --- /dev/null +++ b/test/duplicate_consistency/ledakemlt12_leaktime.yml @@ -0,0 +1,32 @@ +consistency_checks: +- source: + scheme: ledakemlt32 + implementation: leaktime + files: + - bf_decoding.c + - dfr_test.c + - dfr_test.h + - gf2x_arith.c + - gf2x_arith.h + - H_Q_matrices_generation.c + - H_Q_matrices_generation.h + - kem.c + - niederreiter.c + - niederreiter.h + - rng.c + - rng.h +- source: + scheme: ledakemlt52 + implementation: leaktime + files: + - bf_decoding.c + - dfr_test.c + - dfr_test.h + - gf2x_arith.c + - gf2x_arith.h + - H_Q_matrices_generation.c + - H_Q_matrices_generation.h + - kem.c + - niederreiter.c + - niederreiter.h + - rng.h diff --git a/test/duplicate_consistency/ledakemlt32_leaktime.yml b/test/duplicate_consistency/ledakemlt32_leaktime.yml new file mode 100644 index 00000000..ec6d6e50 --- /dev/null +++ b/test/duplicate_consistency/ledakemlt32_leaktime.yml @@ -0,0 +1,32 @@ +consistency_checks: +- source: + scheme: ledakemlt12 + implementation: leaktime + files: + - bf_decoding.c + - dfr_test.c + - dfr_test.h + - gf2x_arith.c + - gf2x_arith.h + - H_Q_matrices_generation.c + - H_Q_matrices_generation.h + - kem.c + - niederreiter.c + - niederreiter.h + - rng.c + - rng.h +- source: + scheme: ledakemlt52 + implementation: leaktime + files: + - bf_decoding.c + - dfr_test.c + - dfr_test.h + - gf2x_arith.c + - gf2x_arith.h + - H_Q_matrices_generation.c + - H_Q_matrices_generation.h + - kem.c + - niederreiter.c + - niederreiter.h + - rng.h diff --git a/test/duplicate_consistency/ledakemlt52_leaktime.yml b/test/duplicate_consistency/ledakemlt52_leaktime.yml new file mode 100644 index 00000000..b7602e85 --- /dev/null +++ b/test/duplicate_consistency/ledakemlt52_leaktime.yml @@ -0,0 +1,32 @@ +consistency_checks: +- source: + scheme: ledakemlt12 + implementation: leaktime + files: + - bf_decoding.c + - dfr_test.c + - dfr_test.h + - gf2x_arith.c + - gf2x_arith.h + - H_Q_matrices_generation.c + - H_Q_matrices_generation.h + - kem.c + - niederreiter.c + - niederreiter.h + - rng.h +- source: + scheme: ledakemlt32 + implementation: leaktime + files: + - bf_decoding.c + - dfr_test.c + - dfr_test.h + - gf2x_arith.c + - gf2x_arith.h + - gf2x_arith_mod_xPplusOne.c + - H_Q_matrices_generation.c + - H_Q_matrices_generation.h + - kem.c + - niederreiter.c + - niederreiter.h + - rng.h