fix requested changes

crypto_kem/ledakemlt12/leaktime/H_Q_matrices_generation.c

@@ -1,23 +1,19 @@
 #include "H_Q_matrices_generation.h"
 #include "gf2x_arith_mod_xPplusOne.h"
 
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV],
-        AES_XOF_struct *keys_expander) {
-
-    for (int i = 0; i < N0; i++) {
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], AES_XOF_struct *keys_expander) {
+    for (size_t i = 0; i < N0; i++) {
         /* Generate a random block of Htr */
-        PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0],
-                DV,
-                keys_expander);
+        PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], DV, keys_expander);
     }
 }
 
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M],
-        AES_XOF_struct *keys_expander) {
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], AES_XOF_struct *keys_expander) {
+    size_t placed_ones;
 
-    for (int i = 0; i < N0; i++) {
-        int placed_ones = 0;
-        for (int j = 0; j < N0; j++) {
+    for (size_t i = 0; i < N0; i++) {
+        placed_ones = 0;
+        for (size_t j = 0; j < N0; j++) {
             PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones],
                     qBlockWeights[i][j],
                     keys_expander);
@@ -26,29 +22,27 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M],
     }
 }
 
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], /* output*/
-        POSITION_T HPosOnes[N0][DV]) {
-
-    for (int i = 0; i < N0; i++) {
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], POSITION_T HPosOnes[N0][DV]) {
+    for (size_t i = 0; i < N0; i++) {
         /* Obtain directly the sparse representation of the block of H */
-        for (int k = 0; k < DV; k++) {
+        for (size_t k = 0; k < DV; k++) {
             HtrPosOnes[i][k] = (P - HPosOnes[i][k])  % P; /* transposes indexes */
-        }// end for k
+        }
     }
 }
 
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], /* output*/
-        POSITION_T QPosOnes[N0][M]) {
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], POSITION_T QPosOnes[N0][M]) {
+    POSITION_T transposed_ones_idx[N0] = {0x00};
+    size_t currQoneIdx, endQblockIdx;
 
-    unsigned transposed_ones_idx[N0] = {0x00};
-    for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) {
-        int currQoneIdx = 0; // position in the column of QtrPosOnes[][...]
-        int endQblockIdx = 0;
+    for (size_t source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) {
+        currQoneIdx = 0; // position in the column of QtrPosOnes[][...]
+        endQblockIdx = 0;
         for (int blockIdx = 0; blockIdx < N0; blockIdx++) {
             endQblockIdx += qBlockWeights[source_row_idx][blockIdx];
             for (; currQoneIdx < endQblockIdx; currQoneIdx++) {
-                QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P -
-                        QPosOnes[source_row_idx][currQoneIdx]) % P;
+                QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] =
+                    (P - QPosOnes[source_row_idx][currQoneIdx]) % P;
                 transposed_ones_idx[blockIdx]++;
             }
         }

crypto_kem/ledakemlt12/leaktime/bf_decoding.c

@@ -7,22 +7,26 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(DIGIT err[],
         const POSITION_T HtrPosOnes[N0][DV],
         const POSITION_T QtrPosOnes[N0][M],
         DIGIT privateSyndrome[],
-        uint8_t threshold) {
+        uint8_t secondIterThreshold) {
 
+    DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT];
     uint8_t unsatParityChecks[N0 * P];
     POSITION_T currQBlkPos[M], currQBitPos[M];
-    DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT];
+    POSITION_T syndromePosToFlip, tmp;
+    unsigned int correlation, corrt_syndrome_based;
+    size_t currQoneIdx, endQblockIdx, currblockoffset;
     int check;
     int iteration = 0;
-    unsigned int corrt_syndrome_based;
 
     do {
         PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome);
         memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t));
-        for (int i = 0; i < N0; i++) {
-            for (int valueIdx = 0; valueIdx < P; valueIdx++) {
-                for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
-                    POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx);
+        for (size_t i = 0; i < N0; i++) {
+            for (size_t valueIdx = 0; valueIdx < P; valueIdx++) {
+                for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
+                    tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ?
+                          (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P :
+                          (HtrPosOnes[i][HtrOneIdx] + valueIdx);
                     if (PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) {
                         unsatParityChecks[i * P + valueIdx]++;
                     }
@@ -31,33 +35,32 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(DIGIT err[],
         }
 
         /* iteration based threshold determination*/
-        corrt_syndrome_based = iteration ? (unsigned int) threshold : B0;
+        corrt_syndrome_based = iteration * secondIterThreshold + (1 - iteration) * B0;
 
-        //Computation of correlation  with a full Q matrix
-        for (int i = 0; i < N0; i++) {
-            for (int j = 0; j < P; j++) {
-                int currQoneIdx = 0; // position in the column of QtrPosOnes[][...]
-                int endQblockIdx = 0;
-                unsigned int correlation = 0;
+        // Computation of correlation  with a full Q matrix
+        for (size_t i = 0; i < N0; i++) {
+            for (size_t j = 0; j < P; j++) {
+                currQoneIdx =  endQblockIdx = 0;
+                correlation = 0;
 
-                for (int blockIdx = 0; blockIdx < N0; blockIdx++) {
+                for (size_t blockIdx = 0; blockIdx < N0; blockIdx++) {
                     endQblockIdx += qBlockWeights[blockIdx][i];
-                    int currblockoffset = blockIdx * P;
+                    currblockoffset = blockIdx * P;
                     for (; currQoneIdx < endQblockIdx; currQoneIdx++) {
-                        POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j;
+                        tmp = QtrPosOnes[i][currQoneIdx] + j;
                         tmp = tmp >= P ? tmp - P : tmp;
                         currQBitPos[currQoneIdx] = tmp;
                         currQBlkPos[currQoneIdx] = blockIdx;
                         correlation += unsatParityChecks[tmp + currblockoffset];
                     }
                 }
+
                 /* Correlation based flipping */
                 if (correlation >= corrt_syndrome_based) {
                     PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j);
-                    for (int v = 0; v < M; v++) {
-                        POSITION_T syndromePosToFlip;
-                        for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
-                            syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] );
+                    for (size_t v = 0; v < M; v++) {
+                        for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
+                            syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v]);
                             syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip;
                             PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip);
                         }

crypto_kem/ledakemlt12/leaktime/dfr_test.c

@@ -14,47 +14,49 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_
     unsigned int maxMut[N0], maxMutMinusOne[N0];
     unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne;
     unsigned int gammaHist[N0][DV * M + 1] = {{0}};
+    unsigned int toAdd;
+    size_t histIdx;
 
-    for (int i = 0; i < N0; i++) {
-        for (int j = 0; j < DV * M; j++) {
+    for (size_t i = 0; i < N0; i++) {
+        for (size_t j = 0; j < DV * M; j++) {
             if (LSparse[i][j] != 0) {
-                LSparse_loc[i][j] = (P - LSparse[i][j]) ;
+                LSparse_loc[i][j] = (P - LSparse[i][j]);
             }
         }
         PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M);
     }
 
 
-    for (int i = 0; i < N0; i++ ) {
-        for (int j = 0; j < N0; j++ ) {
-            for (int k = 0; k < (DV * M); k++) {
-                for (int l = 0; l < (DV * M); l++) {
-                    gamma[i][j][ (P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P ]++;
+    for (size_t i = 0; i < N0; i++ ) {
+        for (size_t j = 0; j < N0; j++) {
+            for (size_t k = 0; k < (DV * M); k++) {
+                for (size_t l = 0; l < (DV * M); l++) {
+                    gamma[i][j][(P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P]++;
                 }
             }
         }
     }
 
-    for (int i = 0; i < N0; i++ ) {
-        for (int j = 0; j < N0; j++ ) {
+    for (size_t i = 0; i < N0; i++ ) {
+        for (size_t j = 0; j < N0; j++ ) {
             gamma[i][j][0] = 0;
         }
     }
 
     /* build histogram of values in gamma */
-    for (int i = 0; i < N0; i++ ) {
-        for (int j = 0; j < N0; j++ ) {
-            for (int k = 0; k < P; k++) {
+    for (size_t i = 0; i < N0; i++ ) {
+        for (size_t j = 0; j < N0; j++ ) {
+            for (size_t k = 0; k < P; k++) {
                 gammaHist[i][gamma[i][j][k]]++;
             }
         }
     }
 
 
-    for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) {
-        unsigned int toAdd = T_BAR - 1;
+    for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) {
         maxMutMinusOne[gammaBlockRowIdx] = 0;
-        unsigned int histIdx = DV * M;
+        histIdx = DV * M;
+        toAdd = T_BAR - 1;
         while ( (histIdx > 0) && (toAdd > 0)) {
             if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) {
                 maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd;
@@ -71,7 +73,7 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_
     /*seek max values across all gamma blocks */
     allBlockMaxSumst = maxMut[0];
     allBlockMaxSumstMinusOne = maxMutMinusOne[0];
-    for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) {
+    for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) {
         allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ?
                            maxMut[gammaBlockRowIdx] :
                            allBlockMaxSumst;

crypto_kem/ledakemlt12/leaktime/gf2x_arith.c

@@ -52,7 +52,7 @@ static void gf2x_mul1(DIGIT *R, const DIGIT A, const DIGIT B) {
 
     R[0] = 0;
     R[1] = (A & 1) * B;
-    for (unsigned i = 1; i < DIGIT_SIZE_b; i++) {
+    for (uint8_t i = 1; i < DIGIT_SIZE_b; i++) {
         tmp = ((A >> i) & 1) * B;
         R[1] ^= tmp << i;
         R[0] ^= tmp >> (DIGIT_SIZE_b - i);

crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.c

@@ -5,39 +5,39 @@
 #include <string.h>  // memcpy(...), memset(...)
 
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) {
-    for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) {
+    for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
         dest[i] = in[i];
     }
 }
 
 /* returns the coefficient of the x^exponent term as the LSB of a digit */
-DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) {
-    unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
-    unsigned int digitIdx = straightIdx / DIGIT_SIZE_b;
-    unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b;
+DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent) {
+    size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
+    size_t digitIdx = straightIdx / DIGIT_SIZE_b;
+    size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
     return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ;
 }
 
 /* sets the coefficient of the x^exponent term as the LSB of a digit */
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) {
-    unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
-    unsigned int digitIdx = straightIdx / DIGIT_SIZE_b;
-    unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b;
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value) {
+    size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
+    size_t digitIdx = straightIdx / DIGIT_SIZE_b;
+    size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
 
     /* clear given coefficient */
-    DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
+    DIGIT mask = ~(((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
     poly[digitIdx] = poly[digitIdx] & mask;
-    poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx));
+    poly[digitIdx] = poly[digitIdx] | ((value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx));
 }
 
 /* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) {
-    unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
-    unsigned int digitIdx = straightIdx / DIGIT_SIZE_b;
-    unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b;
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent) {
+    size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
+    size_t digitIdx = straightIdx / DIGIT_SIZE_b;
+    size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
 
     /* clear given coefficient */
-    DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
+    DIGIT mask = (((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
     poly[digitIdx] = poly[digitIdx] ^ mask;
 }
 
@@ -51,7 +51,7 @@ static int popcount_uint64t(uint64_t x) {
 }
 
 /* population count for a single polynomial */
-int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(DIGIT *poly) {
+int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(const DIGIT *poly) {
     int ret = 0;
     for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) {
         ret += popcount_uint64t(poly[i]);
@@ -74,10 +74,9 @@ static void gf2x_mod(DIGIT out[],  const DIGIT in[]) {
     out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1;
 }
 
-static void right_bit_shift(unsigned int length, DIGIT in[]) {
-
-    unsigned int j;
-    for (j = length - 1; j > 0 ; j--) {
+static void right_bit_shift(size_t length, DIGIT in[]) {
+    size_t j;
+    for (j = length - 1; j > 0; j--) {
         in[j] >>= 1;
         in[j] |=  (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1);
     }
@@ -86,8 +85,8 @@ static void right_bit_shift(unsigned int length, DIGIT in[]) {
 
 
 /* shifts by whole digits */
-static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) {
-    unsigned int j;
+static void left_DIGIT_shift_n(size_t length, DIGIT in[], size_t amount) {
+    size_t j;
     for (j = 0; (j + amount) < length; j++) {
         in[j] = in[j + amount];
     }
@@ -97,7 +96,7 @@ static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amo
 }
 
 /* may shift by an arbitrary amount*/
-static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) {
+static void left_bit_shift_wide_n(size_t length, DIGIT in[], size_t amount) {
     left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b);
     PQCLEAN_LEDAKEMLT12_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b);
 }
@@ -123,19 +122,21 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) {
 
     DIGIT mask = (DIGIT)0x1;
     DIGIT rev1, rev2, a00;
-    int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P;
+    int slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P;
 
     a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask;
     right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A);
 
-    for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) {
+    for (size_t i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) {
         rev1 = reverse_digit(A[i]);
         rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]);
         A[i] = rev2;
         A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1;
     }
 
-    A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]);
+    if (NUM_DIGITS_GF2X_ELEMENT % 2 == 1) {
+        A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]);
+    }
 
     if (slack_bits_amount) {
         PQCLEAN_LEDAKEMLT12_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount);
@@ -153,10 +154,9 @@ static void rotate_bit_right(DIGIT in[]) { /*  x^{-1} * in(x) mod x^P+1 */
 }
 
 /* cond swap: swaps digits A and B if swap_mask == -1 */
-static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) {
-    int i;
+static void gf2x_cswap(DIGIT *a, DIGIT *b, int32_t swap_mask) {
     DIGIT t;
-    for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
+    for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
         t = swap_mask & (a[i] ^ b[i]);
         a[i] ^= t;
         b[i] ^= t;
@@ -164,18 +164,18 @@ static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) {
 }
 
 /* returns -1 mask if x != 0, otherwise 0 */
-static inline int nonzero(DIGIT x) {
+static inline int32_t nonzero(DIGIT x) {
     DIGIT t = x;
     t = (~t) + 1;
     t >>= DIGIT_SIZE_b - 1;
-    return -((int)t);
+    return -((int32_t)t);
 }
 
 /* returns -1 mask if x < 0 else 0 */
-static inline int negative(int x) {
+static inline int32_t negative(int x) {
     uint32_t u = x;
     u >>= 31;
-    return -((int)u);
+    return -((int32_t)u);
 }
 
 /* return f(0) as digit */
@@ -193,7 +193,7 @@ static void gf2x_mult_scalar_acc(DIGIT *f, const DIGIT *g, const DIGIT s) {
 
 /* constant-time inverse, source: gcd.cr.yp.to */
 int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) {
-    int i, loop, swap, delta = 1;
+    int32_t swap, delta = 1;
     DIGIT g0_mask;
 
     DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1
@@ -204,17 +204,17 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[])
     f[NUM_DIGITS_GF2X_MODULUS - 1] = 1;
     f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS);
 
-    for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
+    for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
         g[i] = in[i];
     }
 
-    for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
+    for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
         v[i] = 0;
     }
 
     r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1;
 
-    for (loop = 0; loop < 2 * P - 1; ++loop) {
+    for (int loop = 0; loop < 2 * P - 1; ++loop) {
 
         swap = negative(-delta) & nonzero(lsb(g));              // swap = -1 if -delta < 0 AND g(0) != 0
         delta ^= swap & (delta ^ -delta);                       // cond swap delta with -delta if swap
@@ -249,7 +249,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], con
 /*PRE: the representation of the sparse coefficients is sorted in increasing
  order of the coefficients themselves */
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[],
-        POSITION_T sparse[], unsigned int nPos) {
+        POSITION_T sparse[], size_t nPos) {
 
     DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00};
     DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00};
@@ -260,7 +260,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons
         left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]);
         left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]);
 
-        for (unsigned int i = 1; i < nPos; i++) {
+        for (size_t i = 1; i < nPos; i++) {
             if (sparse[i] != INVALID_POS_VALUE) {
                 left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) );
                 PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT);
@@ -272,10 +272,9 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons
 
 }
 
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) {
-
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]) {
     POSITION_T t;
-    int i = 0, j;
+    size_t i = 0, j;
 
     if (A[i] == 0) {
         i = 1;
@@ -299,6 +298,9 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
         size_t sizeB, const POSITION_T B[]) {
 
     POSITION_T prod;
+    POSITION_T lastReadPos;
+    size_t duplicateCount;
+    size_t write_idx, read_idx;
 
     /* compute all the coefficients, filling invalid positions with P*/
     size_t lastFilledPos = 0;
@@ -319,12 +321,11 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
         Res[lastFilledPos] = INVALID_POS_VALUE;
         lastFilledPos++;
     }
+
     PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(Res, sizeR);
+
     /* eliminate duplicates */
-    POSITION_T lastReadPos = Res[0];
-    size_t duplicateCount;
-    size_t write_idx = 0;
-    size_t read_idx = 0;
+    write_idx = read_idx = 0;
     while (read_idx < sizeR  && Res[read_idx] != INVALID_POS_VALUE) {
         lastReadPos = Res[read_idx];
         read_idx++;
@@ -346,13 +347,12 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
 
 /* the implementation is safe even in case A or B alias with the result
  * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(
-    int sizeR, POSITION_T Res[],
-    int sizeA, const POSITION_T A[],
-    int sizeB, const POSITION_T B[]) {
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[],
+        size_t sizeA, const POSITION_T A[],
+        size_t sizeB, const POSITION_T B[]) {
 
     POSITION_T tmpRes[DV * M];
-    int idxA = 0, idxB = 0, idxR = 0;
+    size_t idxA = 0, idxB = 0, idxR = 0;
     while ( idxA < sizeA  &&
             idxB < sizeB  &&
             A[idxA] != INVALID_POS_VALUE &&
@@ -421,18 +421,18 @@ static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct
 /* Obtains fresh randomness and seed-expands it until all the required positions
  * for the '1's in the circulant block are obtained */
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones,
-        int countOnes,
+        size_t countOnes,
         AES_XOF_struct *seed_expander_ctx) {
 
-    int duplicated, placedOnes = 0;
-    uint32_t p;
+    size_t duplicated, placedOnes = 0;
+    POSITION_T p;
 
     while (placedOnes < countOnes) {
         p = rand_range(NUM_BITS_GF2X_ELEMENT,
                        P_BITS,
                        seed_expander_ctx);
         duplicated = 0;
-        for (int j = 0; j < placedOnes; j++) {
+        for (size_t j = 0; j < placedOnes; j++) {
             if (pos_ones[j] == p) {
                 duplicated = 1;
             }

crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.h

@@ -16,22 +16,22 @@
 #define P_BITS                                  (16) // log_2(p) = 15.6703
 
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]);
-DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent);
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value);
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent);
-int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(DIGIT *poly);
+DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent);
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value);
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent);
+int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(const DIGIT *poly);
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]);
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]);
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]);
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx);
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, size_t countOnes, AES_XOF_struct *seed_expander_ctx);
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx);
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx);
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]);
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]);
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]);
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]);
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]);
 int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]);
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA,  const POSITION_T A[], size_t sizeB, const POSITION_T B[]);
-void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos);
+void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], size_t nPos);
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly);
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes);
 

crypto_kem/ledakemlt12/leaktime/kem.c

@@ -107,18 +107,19 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
     uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH];
     uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0};
     uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0};
+    int decode_ok, decrypt_ok, equal;
 
     unpack_ct(syndrome, ct);
 
-    int decode_ok = PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(decoded_error_vector,
-                    (const privateKeyNiederreiter_t *)sk, syndrome);
+    decode_ok = PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(decoded_error_vector,
+                (const privateKeyNiederreiter_t *)sk, syndrome);
 
     pack_error(decoded_error_bytes, decoded_error_vector);
     HASH_FUNCTION(hashedErrorVector, decoded_error_bytes, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
 
     memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH);
 
-    for (int i = 0; i < TRNG_BYTE_LENGTH; ++i) {
+    for (size_t i = 0; i < TRNG_BYTE_LENGTH; ++i) {
         decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^
                           hashedAndTruncatedErrorVector[i];
     }
@@ -135,11 +136,11 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
 
     PQCLEAN_LEDAKEMLT12_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos);
 
-    int equal = PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_verify(decoded_error_vector,
-                reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT);
+    equal = PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_verify(decoded_error_vector,
+            reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT);
     // equal == 0, if the reconstructed error vector match !!!
 
-    int decryptOk = (decode_ok == 1 && equal == 0);
+    decrypt_ok = (decode_ok == 1 && equal == 0);
 
     memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH);
     memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH);
@@ -148,7 +149,7 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
     PQCLEAN_LEDAKEMLT12_LEAKTIME_cmov(ss_input + sizeof(decoded_seed),
                                       ((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret,
                                       TRNG_BYTE_LENGTH,
-                                      !decryptOk);
+                                      !decrypt_ok);
 
     HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH);
 

crypto_kem/ledakemlt12/leaktime/niederreiter.c

@@ -49,7 +49,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p
             }
         }
         is_L_full = 1;
-        for (int i = 0; i < N0; i++) {
+        for (size_t i = 0; i < N0; i++) {
             is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE);
         }
         sk->rejections = sk->rejections + 1;
@@ -63,21 +63,21 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p
             sk->decryption_failure_secret,
             (unsigned long)TRNG_BYTE_LENGTH);
 
-    for (int j = 0; j < DV * M; j++) {
+    for (size_t j = 0; j < DV * M; j++) {
         if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) {
             PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1);
         }
     }
 
     PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense);
-    for (int i = 0; i < N0 - 1; i++) {
+    for (size_t i = 0; i < N0 - 1; i++) {
         PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT,
                 Ln0Inv,
                 LPosOnes[i],
                 DV * M);
     }
 
-    for (int i = 0; i < N0 - 1; i++) {
+    for (size_t i = 0; i < N0 - 1; i++) {
         PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT);
     }
 }
@@ -110,24 +110,27 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
     POSITION_T auxSparse[DV * M];
     POSITION_T Ln0trSparse[DV * M];
     DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0};
+    DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B];
     DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT];
-    unsigned char processedQOnes[N0];
+    uint8_t processedQOnes[N0];
     int rejections = sk->rejections;
+    int decrypt_ok = 0;
+    int err_weight;
 
     PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed);
     do {
         PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander);
         PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander);
 
-        for (int i = 0; i < N0; i++) {
-            for (int j = 0; j < DV * M; j++) {
+        for (size_t i = 0; i < N0; i++) {
+            for (size_t j = 0; j < DV * M; j++) {
                 LPosOnes[i][j] = INVALID_POS_VALUE;
             }
         }
 
         memset(processedQOnes, 0x00, sizeof(processedQOnes));
-        for (int colQ = 0; colQ < N0; colQ++) {
-            for (int i = 0; i < N0; i++) {
+        for (size_t colQ = 0; colQ < N0; colQ++) {
+            for (size_t i = 0; i < N0; i++) {
                 PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes,
                         DV, HPosOnes[i],
                         qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]);
@@ -143,15 +146,15 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
     PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes);
     PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes);
 
-    for (int i = 0; i < DV * M; i++) {
+    for (size_t i = 0; i < DV * M; i++) {
         Ln0trSparse[i] = INVALID_POS_VALUE;
         auxSparse[i] = INVALID_POS_VALUE;
     }
 
-    for (int i = 0; i < N0; i++) {
+    for (size_t i = 0; i < N0; i++) {
         PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse,
                 DV, HPosOnes[i],
-                qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1] ] );
+                qBlockWeights[i][N0 - 1], &QPosOnes[i][M - qBlockWeights[i][N0 - 1]]);
         PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse,
                 DV * M, Ln0trSparse,
                 DV * M, auxSparse);
@@ -163,28 +166,27 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
             Ln0trSparse,
             DV * M);
 
-    int decryptOk = 0;
-    decryptOk = PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(err_computed,
-                (const POSITION_T (*)[DV]) HtrPosOnes,
-                (const POSITION_T (*)[M])  QtrPosOnes,
-                privateSyndrome, sk->secondIterThreshold);
+    decrypt_ok = PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(err_computed,
+                 (const POSITION_T (*)[DV]) HtrPosOnes,
+                 (const POSITION_T (*)[M])  QtrPosOnes,
+                 privateSyndrome, sk->secondIterThreshold);
 
-    int err_weight = 0;
-    for (int i = 0 ; i < N0; i++) {
+    err_weight = 0;
+    for (size_t i = 0 ; i < N0; i++) {
         err_weight += PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i));
     }
-    decryptOk = decryptOk && (err_weight == NUM_ERRORS_T);
+    decrypt_ok = decrypt_ok && (err_weight == NUM_ERRORS_T);
 
     /* prepare mockup error vector in case a decoding failure occurs */
-    DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B];
     memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
     memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH);
     memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00,
            (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH);
 
     memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
+
     // Overwrite on decryption failure
-    PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decryptOk);
+    PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decrypt_ok);
 
-    return decryptOk;
+    return decrypt_ok;
 }

crypto_kem/ledakemlt12/leaktime/rng.c

@@ -13,8 +13,8 @@
  maxlen         - maximum number of bytes (less than 2**32) generated under this seed and diversifier
  */
 static void seedexpander_init(AES_XOF_struct *ctx,
-                              unsigned char *seed,
-                              unsigned char *diversifier,
+                              uint8_t *seed,
+                              uint8_t *diversifier,
                               size_t maxlen) {
 
     ctx->length_remaining = maxlen;
@@ -38,13 +38,13 @@ static void seedexpander_init(AES_XOF_struct *ctx,
 }
 
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx,
-        const unsigned char *trng_entropy
+        const uint8_t *trng_entropy
         /* TRNG_BYTE_LENGTH wide buffer */) {
 
     /*the NIST seedexpander will however access 32B from this buffer */
     unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH;
-    unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 };
-    unsigned char diversifier[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+    uint8_t prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = {0x00};
+    uint8_t diversifier[8] = {0};
 
     memcpy(prng_buffer,
            trng_entropy,
@@ -61,7 +61,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx,
     x    - returns the XOF data
     xlen - number of bytes to return
  */
-int PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) {
+int PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(AES_XOF_struct *ctx, uint8_t *x, size_t xlen) {
     size_t offset;
     aes256ctx ctx256;
 

crypto_kem/ledakemlt12/leaktime/sort.c

@@ -5,6 +5,17 @@
     Source: https://sorting.cr.yp.to
 */
 
+#define int32_MINMAX(a,b) \
+    do { \
+        int32 ab = (b) ^ (a); \
+        int32 c = (b) - (a); \
+        c ^= ab & (c ^ (b)); \
+        c >>= 31; \
+        c &= ab; \
+        (a) ^= c; \
+        (b) ^= c; \
+    } while(0)
+
 static void int32_sort(int32 *x, size_t n) {
     size_t top, p, q, r, i, j;
 

crypto_kem/ledakemlt12/leaktime/sort.h

@@ -6,17 +6,6 @@
 
 #define int32 int32_t
 
-#define int32_MINMAX(a,b) \
-    do { \
-        int32 ab = (b) ^ (a); \
-        int32 c = (b) - (a); \
-        c ^= ab & (c ^ (b)); \
-        c >>= 31; \
-        c &= ab; \
-        (a) ^= c; \
-        (b) ^= c; \
-    } while(0)
-
 void PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(uint32_t *x, size_t n);
 
 #endif

crypto_kem/ledakemlt32/leaktime/H_Q_matrices_generation.c

@@ -1,23 +1,19 @@
 #include "H_Q_matrices_generation.h"
 #include "gf2x_arith_mod_xPplusOne.h"
 
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV],
-        AES_XOF_struct *keys_expander) {
-
-    for (int i = 0; i < N0; i++) {
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], AES_XOF_struct *keys_expander) {
+    for (size_t i = 0; i < N0; i++) {
         /* Generate a random block of Htr */
-        PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0],
-                DV,
-                keys_expander);
+        PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], DV, keys_expander);
     }
 }
 
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M],
-        AES_XOF_struct *keys_expander) {
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], AES_XOF_struct *keys_expander) {
+    size_t placed_ones;
 
-    for (int i = 0; i < N0; i++) {
-        int placed_ones = 0;
-        for (int j = 0; j < N0; j++) {
+    for (size_t i = 0; i < N0; i++) {
+        placed_ones = 0;
+        for (size_t j = 0; j < N0; j++) {
             PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones],
                     qBlockWeights[i][j],
                     keys_expander);
@@ -26,29 +22,27 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M],
     }
 }
 
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], /* output*/
-        POSITION_T HPosOnes[N0][DV]) {
-
-    for (int i = 0; i < N0; i++) {
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], POSITION_T HPosOnes[N0][DV]) {
+    for (size_t i = 0; i < N0; i++) {
         /* Obtain directly the sparse representation of the block of H */
-        for (int k = 0; k < DV; k++) {
+        for (size_t k = 0; k < DV; k++) {
             HtrPosOnes[i][k] = (P - HPosOnes[i][k])  % P; /* transposes indexes */
-        }// end for k
+        }
     }
 }
 
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], /* output*/
-        POSITION_T QPosOnes[N0][M]) {
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], POSITION_T QPosOnes[N0][M]) {
+    POSITION_T transposed_ones_idx[N0] = {0x00};
+    size_t currQoneIdx, endQblockIdx;
 
-    unsigned transposed_ones_idx[N0] = {0x00};
-    for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) {
-        int currQoneIdx = 0; // position in the column of QtrPosOnes[][...]
-        int endQblockIdx = 0;
+    for (size_t source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) {
+        currQoneIdx = 0; // position in the column of QtrPosOnes[][...]
+        endQblockIdx = 0;
         for (int blockIdx = 0; blockIdx < N0; blockIdx++) {
             endQblockIdx += qBlockWeights[source_row_idx][blockIdx];
             for (; currQoneIdx < endQblockIdx; currQoneIdx++) {
-                QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P -
-                        QPosOnes[source_row_idx][currQoneIdx]) % P;
+                QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] =
+                    (P - QPosOnes[source_row_idx][currQoneIdx]) % P;
                 transposed_ones_idx[blockIdx]++;
             }
         }

crypto_kem/ledakemlt32/leaktime/bf_decoding.c

@@ -7,22 +7,26 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(DIGIT err[],
         const POSITION_T HtrPosOnes[N0][DV],
         const POSITION_T QtrPosOnes[N0][M],
         DIGIT privateSyndrome[],
-        uint8_t threshold) {
+        uint8_t secondIterThreshold) {
 
+    DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT];
     uint8_t unsatParityChecks[N0 * P];
     POSITION_T currQBlkPos[M], currQBitPos[M];
-    DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT];
+    POSITION_T syndromePosToFlip, tmp;
+    unsigned int correlation, corrt_syndrome_based;
+    size_t currQoneIdx, endQblockIdx, currblockoffset;
     int check;
     int iteration = 0;
-    unsigned int corrt_syndrome_based;
 
     do {
         PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome);
         memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t));
-        for (int i = 0; i < N0; i++) {
-            for (int valueIdx = 0; valueIdx < P; valueIdx++) {
-                for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
-                    POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx);
+        for (size_t i = 0; i < N0; i++) {
+            for (size_t valueIdx = 0; valueIdx < P; valueIdx++) {
+                for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
+                    tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ?
+                          (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P :
+                          (HtrPosOnes[i][HtrOneIdx] + valueIdx);
                     if (PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) {
                         unsatParityChecks[i * P + valueIdx]++;
                     }
@@ -31,33 +35,32 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(DIGIT err[],
         }
 
         /* iteration based threshold determination*/
-        corrt_syndrome_based = iteration ? (unsigned int) threshold : B0;
+        corrt_syndrome_based = iteration * secondIterThreshold + (1 - iteration) * B0;
 
-        //Computation of correlation  with a full Q matrix
-        for (int i = 0; i < N0; i++) {
-            for (int j = 0; j < P; j++) {
-                int currQoneIdx = 0; // position in the column of QtrPosOnes[][...]
-                int endQblockIdx = 0;
-                unsigned int correlation = 0;
+        // Computation of correlation  with a full Q matrix
+        for (size_t i = 0; i < N0; i++) {
+            for (size_t j = 0; j < P; j++) {
+                currQoneIdx =  endQblockIdx = 0;
+                correlation = 0;
 
-                for (int blockIdx = 0; blockIdx < N0; blockIdx++) {
+                for (size_t blockIdx = 0; blockIdx < N0; blockIdx++) {
                     endQblockIdx += qBlockWeights[blockIdx][i];
-                    int currblockoffset = blockIdx * P;
+                    currblockoffset = blockIdx * P;
                     for (; currQoneIdx < endQblockIdx; currQoneIdx++) {
-                        POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j;
+                        tmp = QtrPosOnes[i][currQoneIdx] + j;
                         tmp = tmp >= P ? tmp - P : tmp;
                         currQBitPos[currQoneIdx] = tmp;
                         currQBlkPos[currQoneIdx] = blockIdx;
                         correlation += unsatParityChecks[tmp + currblockoffset];
                     }
                 }
+
                 /* Correlation based flipping */
                 if (correlation >= corrt_syndrome_based) {
                     PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j);
-                    for (int v = 0; v < M; v++) {
-                        POSITION_T syndromePosToFlip;
-                        for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
-                            syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] );
+                    for (size_t v = 0; v < M; v++) {
+                        for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
+                            syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v]);
                             syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip;
                             PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip);
                         }

crypto_kem/ledakemlt32/leaktime/dfr_test.c

@@ -14,47 +14,49 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_
     unsigned int maxMut[N0], maxMutMinusOne[N0];
     unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne;
     unsigned int gammaHist[N0][DV * M + 1] = {{0}};
+    unsigned int toAdd;
+    size_t histIdx;
 
-    for (int i = 0; i < N0; i++) {
-        for (int j = 0; j < DV * M; j++) {
+    for (size_t i = 0; i < N0; i++) {
+        for (size_t j = 0; j < DV * M; j++) {
             if (LSparse[i][j] != 0) {
-                LSparse_loc[i][j] = (P - LSparse[i][j]) ;
+                LSparse_loc[i][j] = (P - LSparse[i][j]);
             }
         }
         PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M);
     }
 
 
-    for (int i = 0; i < N0; i++ ) {
-        for (int j = 0; j < N0; j++ ) {
-            for (int k = 0; k < (DV * M); k++) {
-                for (int l = 0; l < (DV * M); l++) {
-                    gamma[i][j][ (P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P ]++;
+    for (size_t i = 0; i < N0; i++ ) {
+        for (size_t j = 0; j < N0; j++) {
+            for (size_t k = 0; k < (DV * M); k++) {
+                for (size_t l = 0; l < (DV * M); l++) {
+                    gamma[i][j][(P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P]++;
                 }
             }
         }
     }
 
-    for (int i = 0; i < N0; i++ ) {
-        for (int j = 0; j < N0; j++ ) {
+    for (size_t i = 0; i < N0; i++ ) {
+        for (size_t j = 0; j < N0; j++ ) {
             gamma[i][j][0] = 0;
         }
     }
 
     /* build histogram of values in gamma */
-    for (int i = 0; i < N0; i++ ) {
-        for (int j = 0; j < N0; j++ ) {
-            for (int k = 0; k < P; k++) {
+    for (size_t i = 0; i < N0; i++ ) {
+        for (size_t j = 0; j < N0; j++ ) {
+            for (size_t k = 0; k < P; k++) {
                 gammaHist[i][gamma[i][j][k]]++;
             }
         }
     }
 
 
-    for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) {
-        unsigned int toAdd = T_BAR - 1;
+    for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) {
         maxMutMinusOne[gammaBlockRowIdx] = 0;
-        unsigned int histIdx = DV * M;
+        histIdx = DV * M;
+        toAdd = T_BAR - 1;
         while ( (histIdx > 0) && (toAdd > 0)) {
             if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) {
                 maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd;
@@ -71,7 +73,7 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_
     /*seek max values across all gamma blocks */
     allBlockMaxSumst = maxMut[0];
     allBlockMaxSumstMinusOne = maxMutMinusOne[0];
-    for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) {
+    for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) {
         allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ?
                            maxMut[gammaBlockRowIdx] :
                            allBlockMaxSumst;

crypto_kem/ledakemlt32/leaktime/gf2x_arith.c

@@ -52,7 +52,7 @@ static void gf2x_mul1(DIGIT *R, const DIGIT A, const DIGIT B) {
 
     R[0] = 0;
     R[1] = (A & 1) * B;
-    for (unsigned i = 1; i < DIGIT_SIZE_b; i++) {
+    for (uint8_t i = 1; i < DIGIT_SIZE_b; i++) {
         tmp = ((A >> i) & 1) * B;
         R[1] ^= tmp << i;
         R[0] ^= tmp >> (DIGIT_SIZE_b - i);

crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.c

@@ -5,39 +5,39 @@
 #include <string.h>  // memcpy(...), memset(...)
 
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) {
-    for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) {
+    for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
         dest[i] = in[i];
     }
 }
 
 /* returns the coefficient of the x^exponent term as the LSB of a digit */
-DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) {
-    unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
-    unsigned int digitIdx = straightIdx / DIGIT_SIZE_b;
-    unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b;
+DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent) {
+    size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
+    size_t digitIdx = straightIdx / DIGIT_SIZE_b;
+    size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
     return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ;
 }
 
 /* sets the coefficient of the x^exponent term as the LSB of a digit */
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) {
-    unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
-    unsigned int digitIdx = straightIdx / DIGIT_SIZE_b;
-    unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b;
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value) {
+    size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
+    size_t digitIdx = straightIdx / DIGIT_SIZE_b;
+    size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
 
     /* clear given coefficient */
-    DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
+    DIGIT mask = ~(((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
     poly[digitIdx] = poly[digitIdx] & mask;
-    poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx));
+    poly[digitIdx] = poly[digitIdx] | ((value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx));
 }
 
 /* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) {
-    unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
-    unsigned int digitIdx = straightIdx / DIGIT_SIZE_b;
-    unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b;
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent) {
+    size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
+    size_t digitIdx = straightIdx / DIGIT_SIZE_b;
+    size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
 
     /* clear given coefficient */
-    DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
+    DIGIT mask = (((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
     poly[digitIdx] = poly[digitIdx] ^ mask;
 }
 
@@ -51,7 +51,7 @@ static int popcount_uint64t(uint64_t x) {
 }
 
 /* population count for a single polynomial */
-int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(DIGIT *poly) {
+int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(const DIGIT *poly) {
     int ret = 0;
     for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) {
         ret += popcount_uint64t(poly[i]);
@@ -74,10 +74,9 @@ static void gf2x_mod(DIGIT out[],  const DIGIT in[]) {
     out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1;
 }
 
-static void right_bit_shift(unsigned int length, DIGIT in[]) {
-
-    unsigned int j;
-    for (j = length - 1; j > 0 ; j--) {
+static void right_bit_shift(size_t length, DIGIT in[]) {
+    size_t j;
+    for (j = length - 1; j > 0; j--) {
         in[j] >>= 1;
         in[j] |=  (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1);
     }
@@ -86,8 +85,8 @@ static void right_bit_shift(unsigned int length, DIGIT in[]) {
 
 
 /* shifts by whole digits */
-static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) {
-    unsigned int j;
+static void left_DIGIT_shift_n(size_t length, DIGIT in[], size_t amount) {
+    size_t j;
     for (j = 0; (j + amount) < length; j++) {
         in[j] = in[j + amount];
     }
@@ -97,7 +96,7 @@ static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amo
 }
 
 /* may shift by an arbitrary amount*/
-static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) {
+static void left_bit_shift_wide_n(size_t length, DIGIT in[], size_t amount) {
     left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b);
     PQCLEAN_LEDAKEMLT32_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b);
 }
@@ -123,18 +122,22 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) {
 
     DIGIT mask = (DIGIT)0x1;
     DIGIT rev1, rev2, a00;
-    int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P;
+    int slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P;
 
     a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask;
     right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A);
 
-    for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) {
+    for (size_t i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) {
         rev1 = reverse_digit(A[i]);
         rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]);
         A[i] = rev2;
         A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1;
     }
 
+    if (NUM_DIGITS_GF2X_ELEMENT % 2 == 1) {
+        A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]);
+    }
+
     if (slack_bits_amount) {
         PQCLEAN_LEDAKEMLT32_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount);
     }
@@ -151,10 +154,9 @@ static void rotate_bit_right(DIGIT in[]) { /*  x^{-1} * in(x) mod x^P+1 */
 }
 
 /* cond swap: swaps digits A and B if swap_mask == -1 */
-static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) {
-    int i;
+static void gf2x_cswap(DIGIT *a, DIGIT *b, int32_t swap_mask) {
     DIGIT t;
-    for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
+    for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
         t = swap_mask & (a[i] ^ b[i]);
         a[i] ^= t;
         b[i] ^= t;
@@ -162,18 +164,18 @@ static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) {
 }
 
 /* returns -1 mask if x != 0, otherwise 0 */
-static inline int nonzero(DIGIT x) {
+static inline int32_t nonzero(DIGIT x) {
     DIGIT t = x;
     t = (~t) + 1;
     t >>= DIGIT_SIZE_b - 1;
-    return -((int)t);
+    return -((int32_t)t);
 }
 
 /* returns -1 mask if x < 0 else 0 */
-static inline int negative(int x) {
+static inline int32_t negative(int x) {
     uint32_t u = x;
     u >>= 31;
-    return -((int)u);
+    return -((int32_t)u);
 }
 
 /* return f(0) as digit */
@@ -191,7 +193,7 @@ static void gf2x_mult_scalar_acc(DIGIT *f, const DIGIT *g, const DIGIT s) {
 
 /* constant-time inverse, source: gcd.cr.yp.to */
 int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) {
-    int i, loop, swap, delta = 1;
+    int32_t swap, delta = 1;
     DIGIT g0_mask;
 
     DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1
@@ -202,17 +204,17 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[])
     f[NUM_DIGITS_GF2X_MODULUS - 1] = 1;
     f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS);
 
-    for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
+    for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
         g[i] = in[i];
     }
 
-    for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
+    for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
         v[i] = 0;
     }
 
     r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1;
 
-    for (loop = 0; loop < 2 * P - 1; ++loop) {
+    for (int loop = 0; loop < 2 * P - 1; ++loop) {
 
         swap = negative(-delta) & nonzero(lsb(g));              // swap = -1 if -delta < 0 AND g(0) != 0
         delta ^= swap & (delta ^ -delta);                       // cond swap delta with -delta if swap
@@ -247,7 +249,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], con
 /*PRE: the representation of the sparse coefficients is sorted in increasing
  order of the coefficients themselves */
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[],
-        POSITION_T sparse[], unsigned int nPos) {
+        POSITION_T sparse[], size_t nPos) {
 
     DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00};
     DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00};
@@ -258,7 +260,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons
         left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]);
         left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]);
 
-        for (unsigned int i = 1; i < nPos; i++) {
+        for (size_t i = 1; i < nPos; i++) {
             if (sparse[i] != INVALID_POS_VALUE) {
                 left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) );
                 PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT);
@@ -270,10 +272,9 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons
 
 }
 
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) {
-
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]) {
     POSITION_T t;
-    int i = 0, j;
+    size_t i = 0, j;
 
     if (A[i] == 0) {
         i = 1;
@@ -297,6 +298,9 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
         size_t sizeB, const POSITION_T B[]) {
 
     POSITION_T prod;
+    POSITION_T lastReadPos;
+    size_t duplicateCount;
+    size_t write_idx, read_idx;
 
     /* compute all the coefficients, filling invalid positions with P*/
     size_t lastFilledPos = 0;
@@ -317,12 +321,11 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
         Res[lastFilledPos] = INVALID_POS_VALUE;
         lastFilledPos++;
     }
+
     PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(Res, sizeR);
+
     /* eliminate duplicates */
-    POSITION_T lastReadPos = Res[0];
-    size_t duplicateCount;
-    size_t write_idx = 0;
-    size_t read_idx = 0;
+    write_idx = read_idx = 0;
     while (read_idx < sizeR  && Res[read_idx] != INVALID_POS_VALUE) {
         lastReadPos = Res[read_idx];
         read_idx++;
@@ -344,13 +347,12 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
 
 /* the implementation is safe even in case A or B alias with the result
  * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(
-    int sizeR, POSITION_T Res[],
-    int sizeA, const POSITION_T A[],
-    int sizeB, const POSITION_T B[]) {
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[],
+        size_t sizeA, const POSITION_T A[],
+        size_t sizeB, const POSITION_T B[]) {
 
     POSITION_T tmpRes[DV * M];
-    int idxA = 0, idxB = 0, idxR = 0;
+    size_t idxA = 0, idxB = 0, idxR = 0;
     while ( idxA < sizeA  &&
             idxB < sizeB  &&
             A[idxA] != INVALID_POS_VALUE &&
@@ -419,18 +421,18 @@ static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct
 /* Obtains fresh randomness and seed-expands it until all the required positions
  * for the '1's in the circulant block are obtained */
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones,
-        int countOnes,
+        size_t countOnes,
         AES_XOF_struct *seed_expander_ctx) {
 
-    int duplicated, placedOnes = 0;
-    uint32_t p;
+    size_t duplicated, placedOnes = 0;
+    POSITION_T p;
 
     while (placedOnes < countOnes) {
         p = rand_range(NUM_BITS_GF2X_ELEMENT,
                        P_BITS,
                        seed_expander_ctx);
         duplicated = 0;
-        for (int j = 0; j < placedOnes; j++) {
+        for (size_t j = 0; j < placedOnes; j++) {
             if (pos_ones[j] == p) {
                 duplicated = 1;
             }

crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.h

@@ -16,22 +16,22 @@
 #define P_BITS                                  (17)
 
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]);
-DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent);
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value);
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent);
-int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(DIGIT *poly);
+DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent);
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value);
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent);
+int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(const DIGIT *poly);
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]);
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]);
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]);
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx);
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, size_t countOnes, AES_XOF_struct *seed_expander_ctx);
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx);
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx);
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]);
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]);
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]);
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]);
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]);
 int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]);
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA,  const POSITION_T A[], size_t sizeB, const POSITION_T B[]);
-void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos);
+void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], size_t nPos);
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly);
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes);
 

crypto_kem/ledakemlt32/leaktime/kem.c

@@ -107,18 +107,19 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
     uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH];
     uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0};
     uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0};
+    int decode_ok, decrypt_ok, equal;
 
     unpack_ct(syndrome, ct);
 
-    int decode_ok = PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(decoded_error_vector,
-                    (const privateKeyNiederreiter_t *)sk, syndrome);
+    decode_ok = PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(decoded_error_vector,
+                (const privateKeyNiederreiter_t *)sk, syndrome);
 
     pack_error(decoded_error_bytes, decoded_error_vector);
     HASH_FUNCTION(hashedErrorVector, decoded_error_bytes, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
 
     memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH);
 
-    for (int i = 0; i < TRNG_BYTE_LENGTH; ++i) {
+    for (size_t i = 0; i < TRNG_BYTE_LENGTH; ++i) {
         decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^
                           hashedAndTruncatedErrorVector[i];
     }
@@ -135,11 +136,11 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
 
     PQCLEAN_LEDAKEMLT32_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos);
 
-    int equal = PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_verify(decoded_error_vector,
-                reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT);
+    equal = PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_verify(decoded_error_vector,
+            reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT);
     // equal == 0, if the reconstructed error vector match !!!
 
-    int decryptOk = (decode_ok == 1 && equal == 0);
+    decrypt_ok = (decode_ok == 1 && equal == 0);
 
     memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH);
     memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH);
@@ -148,7 +149,7 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
     PQCLEAN_LEDAKEMLT32_LEAKTIME_cmov(ss_input + sizeof(decoded_seed),
                                       ((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret,
                                       TRNG_BYTE_LENGTH,
-                                      !decryptOk);
+                                      !decrypt_ok);
 
     HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH);
 

crypto_kem/ledakemlt32/leaktime/niederreiter.c

@@ -49,7 +49,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p
             }
         }
         is_L_full = 1;
-        for (int i = 0; i < N0; i++) {
+        for (size_t i = 0; i < N0; i++) {
             is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE);
         }
         sk->rejections = sk->rejections + 1;
@@ -63,21 +63,21 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p
             sk->decryption_failure_secret,
             (unsigned long)TRNG_BYTE_LENGTH);
 
-    for (int j = 0; j < DV * M; j++) {
+    for (size_t j = 0; j < DV * M; j++) {
         if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) {
             PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1);
         }
     }
 
     PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense);
-    for (int i = 0; i < N0 - 1; i++) {
+    for (size_t i = 0; i < N0 - 1; i++) {
         PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT,
                 Ln0Inv,
                 LPosOnes[i],
                 DV * M);
     }
 
-    for (int i = 0; i < N0 - 1; i++) {
+    for (size_t i = 0; i < N0 - 1; i++) {
         PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT);
     }
 }
@@ -110,24 +110,27 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
     POSITION_T auxSparse[DV * M];
     POSITION_T Ln0trSparse[DV * M];
     DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0};
+    DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B];
     DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT];
-    unsigned char processedQOnes[N0];
+    uint8_t processedQOnes[N0];
     int rejections = sk->rejections;
+    int decrypt_ok = 0;
+    int err_weight;
 
     PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed);
     do {
         PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander);
         PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander);
 
-        for (int i = 0; i < N0; i++) {
-            for (int j = 0; j < DV * M; j++) {
+        for (size_t i = 0; i < N0; i++) {
+            for (size_t j = 0; j < DV * M; j++) {
                 LPosOnes[i][j] = INVALID_POS_VALUE;
             }
         }
 
         memset(processedQOnes, 0x00, sizeof(processedQOnes));
-        for (int colQ = 0; colQ < N0; colQ++) {
-            for (int i = 0; i < N0; i++) {
+        for (size_t colQ = 0; colQ < N0; colQ++) {
+            for (size_t i = 0; i < N0; i++) {
                 PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes,
                         DV, HPosOnes[i],
                         qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]);
@@ -143,15 +146,15 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
     PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes);
     PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes);
 
-    for (int i = 0; i < DV * M; i++) {
+    for (size_t i = 0; i < DV * M; i++) {
         Ln0trSparse[i] = INVALID_POS_VALUE;
         auxSparse[i] = INVALID_POS_VALUE;
     }
 
-    for (int i = 0; i < N0; i++) {
+    for (size_t i = 0; i < N0; i++) {
         PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse,
                 DV, HPosOnes[i],
-                qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1] ] );
+                qBlockWeights[i][N0 - 1], &QPosOnes[i][M - qBlockWeights[i][N0 - 1]]);
         PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse,
                 DV * M, Ln0trSparse,
                 DV * M, auxSparse);
@@ -163,28 +166,27 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
             Ln0trSparse,
             DV * M);
 
-    int decryptOk = 0;
-    decryptOk = PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(err_computed,
-                (const POSITION_T (*)[DV]) HtrPosOnes,
-                (const POSITION_T (*)[M])  QtrPosOnes,
-                privateSyndrome, sk->secondIterThreshold);
+    decrypt_ok = PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(err_computed,
+                 (const POSITION_T (*)[DV]) HtrPosOnes,
+                 (const POSITION_T (*)[M])  QtrPosOnes,
+                 privateSyndrome, sk->secondIterThreshold);
 
-    int err_weight = 0;
-    for (int i = 0 ; i < N0; i++) {
+    err_weight = 0;
+    for (size_t i = 0 ; i < N0; i++) {
         err_weight += PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i));
     }
-    decryptOk = decryptOk && (err_weight == NUM_ERRORS_T);
+    decrypt_ok = decrypt_ok && (err_weight == NUM_ERRORS_T);
 
     /* prepare mockup error vector in case a decoding failure occurs */
-    DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B];
     memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
     memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH);
     memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00,
            (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH);
 
     memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
+
     // Overwrite on decryption failure
-    PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decryptOk);
+    PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decrypt_ok);
 
-    return decryptOk;
+    return decrypt_ok;
 }

crypto_kem/ledakemlt32/leaktime/rng.c

@@ -13,8 +13,8 @@
  maxlen         - maximum number of bytes (less than 2**32) generated under this seed and diversifier
  */
 static void seedexpander_init(AES_XOF_struct *ctx,
-                              unsigned char *seed,
-                              unsigned char *diversifier,
+                              uint8_t *seed,
+                              uint8_t *diversifier,
                               size_t maxlen) {
 
     ctx->length_remaining = maxlen;
@@ -38,13 +38,13 @@ static void seedexpander_init(AES_XOF_struct *ctx,
 }
 
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx,
-        const unsigned char *trng_entropy
+        const uint8_t *trng_entropy
         /* TRNG_BYTE_LENGTH wide buffer */) {
 
     /*the NIST seedexpander will however access 32B from this buffer */
     unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH;
-    unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 };
-    unsigned char diversifier[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+    uint8_t prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = {0x00};
+    uint8_t diversifier[8] = {0};
 
     memcpy(prng_buffer,
            trng_entropy,
@@ -61,7 +61,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx,
     x    - returns the XOF data
     xlen - number of bytes to return
  */
-int PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) {
+int PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(AES_XOF_struct *ctx, uint8_t *x, size_t xlen) {
     size_t offset;
     aes256ctx ctx256;
 

crypto_kem/ledakemlt32/leaktime/sort.c

@@ -5,6 +5,17 @@
     Source: https://sorting.cr.yp.to
 */
 
+#define int32_MINMAX(a,b) \
+    do { \
+        int32 ab = (b) ^ (a); \
+        int32 c = (b) - (a); \
+        c ^= ab & (c ^ (b)); \
+        c >>= 31; \
+        c &= ab; \
+        (a) ^= c; \
+        (b) ^= c; \
+    } while(0)
+
 static void int32_sort(int32 *x, size_t n) {
     size_t top, p, q, r, i, j;
 

crypto_kem/ledakemlt32/leaktime/sort.h

@@ -6,17 +6,6 @@
 
 #define int32 int32_t
 
-#define int32_MINMAX(a,b) \
-    do { \
-        int32 ab = (b) ^ (a); \
-        int32 c = (b) - (a); \
-        c ^= ab & (c ^ (b)); \
-        c >>= 31; \
-        c &= ab; \
-        (a) ^= c; \
-        (b) ^= c; \
-    } while(0)
-
 void PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(uint32_t *x, size_t n);
 
 #endif

crypto_kem/ledakemlt52/leaktime/H_Q_matrices_generation.c

@@ -1,23 +1,19 @@
 #include "H_Q_matrices_generation.h"
 #include "gf2x_arith_mod_xPplusOne.h"
 
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV],
-        AES_XOF_struct *keys_expander) {
-
-    for (int i = 0; i < N0; i++) {
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], AES_XOF_struct *keys_expander) {
+    for (size_t i = 0; i < N0; i++) {
         /* Generate a random block of Htr */
-        PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0],
-                DV,
-                keys_expander);
+        PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], DV, keys_expander);
     }
 }
 
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M],
-        AES_XOF_struct *keys_expander) {
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], AES_XOF_struct *keys_expander) {
+    size_t placed_ones;
 
-    for (int i = 0; i < N0; i++) {
-        int placed_ones = 0;
-        for (int j = 0; j < N0; j++) {
+    for (size_t i = 0; i < N0; i++) {
+        placed_ones = 0;
+        for (size_t j = 0; j < N0; j++) {
             PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones],
                     qBlockWeights[i][j],
                     keys_expander);
@@ -26,29 +22,27 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M],
     }
 }
 
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], /* output*/
-        POSITION_T HPosOnes[N0][DV]) {
-
-    for (int i = 0; i < N0; i++) {
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], POSITION_T HPosOnes[N0][DV]) {
+    for (size_t i = 0; i < N0; i++) {
         /* Obtain directly the sparse representation of the block of H */
-        for (int k = 0; k < DV; k++) {
+        for (size_t k = 0; k < DV; k++) {
             HtrPosOnes[i][k] = (P - HPosOnes[i][k])  % P; /* transposes indexes */
-        }// end for k
+        }
     }
 }
 
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], /* output*/
-        POSITION_T QPosOnes[N0][M]) {
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], POSITION_T QPosOnes[N0][M]) {
+    POSITION_T transposed_ones_idx[N0] = {0x00};
+    size_t currQoneIdx, endQblockIdx;
 
-    unsigned transposed_ones_idx[N0] = {0x00};
-    for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) {
-        int currQoneIdx = 0; // position in the column of QtrPosOnes[][...]
-        int endQblockIdx = 0;
+    for (size_t source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) {
+        currQoneIdx = 0; // position in the column of QtrPosOnes[][...]
+        endQblockIdx = 0;
         for (int blockIdx = 0; blockIdx < N0; blockIdx++) {
             endQblockIdx += qBlockWeights[source_row_idx][blockIdx];
             for (; currQoneIdx < endQblockIdx; currQoneIdx++) {
-                QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P -
-                        QPosOnes[source_row_idx][currQoneIdx]) % P;
+                QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] =
+                    (P - QPosOnes[source_row_idx][currQoneIdx]) % P;
                 transposed_ones_idx[blockIdx]++;
             }
         }

crypto_kem/ledakemlt52/leaktime/bf_decoding.c

@@ -7,22 +7,26 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(DIGIT err[],
         const POSITION_T HtrPosOnes[N0][DV],
         const POSITION_T QtrPosOnes[N0][M],
         DIGIT privateSyndrome[],
-        uint8_t threshold) {
+        uint8_t secondIterThreshold) {
 
+    DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT];
     uint8_t unsatParityChecks[N0 * P];
     POSITION_T currQBlkPos[M], currQBitPos[M];
-    DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT];
+    POSITION_T syndromePosToFlip, tmp;
+    unsigned int correlation, corrt_syndrome_based;
+    size_t currQoneIdx, endQblockIdx, currblockoffset;
     int check;
     int iteration = 0;
-    unsigned int corrt_syndrome_based;
 
     do {
         PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome);
         memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t));
-        for (int i = 0; i < N0; i++) {
-            for (int valueIdx = 0; valueIdx < P; valueIdx++) {
-                for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
-                    POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx);
+        for (size_t i = 0; i < N0; i++) {
+            for (size_t valueIdx = 0; valueIdx < P; valueIdx++) {
+                for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
+                    tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ?
+                          (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P :
+                          (HtrPosOnes[i][HtrOneIdx] + valueIdx);
                     if (PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) {
                         unsatParityChecks[i * P + valueIdx]++;
                     }
@@ -31,33 +35,32 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(DIGIT err[],
         }
 
         /* iteration based threshold determination*/
-        corrt_syndrome_based = iteration ? (unsigned int) threshold : B0;
+        corrt_syndrome_based = iteration * secondIterThreshold + (1 - iteration) * B0;
 
-        //Computation of correlation  with a full Q matrix
-        for (int i = 0; i < N0; i++) {
-            for (int j = 0; j < P; j++) {
-                int currQoneIdx = 0; // position in the column of QtrPosOnes[][...]
-                int endQblockIdx = 0;
-                unsigned int correlation = 0;
+        // Computation of correlation  with a full Q matrix
+        for (size_t i = 0; i < N0; i++) {
+            for (size_t j = 0; j < P; j++) {
+                currQoneIdx =  endQblockIdx = 0;
+                correlation = 0;
 
-                for (int blockIdx = 0; blockIdx < N0; blockIdx++) {
+                for (size_t blockIdx = 0; blockIdx < N0; blockIdx++) {
                     endQblockIdx += qBlockWeights[blockIdx][i];
-                    int currblockoffset = blockIdx * P;
+                    currblockoffset = blockIdx * P;
                     for (; currQoneIdx < endQblockIdx; currQoneIdx++) {
-                        POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j;
+                        tmp = QtrPosOnes[i][currQoneIdx] + j;
                         tmp = tmp >= P ? tmp - P : tmp;
                         currQBitPos[currQoneIdx] = tmp;
                         currQBlkPos[currQoneIdx] = blockIdx;
                         correlation += unsatParityChecks[tmp + currblockoffset];
                     }
                 }
+
                 /* Correlation based flipping */
                 if (correlation >= corrt_syndrome_based) {
                     PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j);
-                    for (int v = 0; v < M; v++) {
-                        POSITION_T syndromePosToFlip;
-                        for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
-                            syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] );
+                    for (size_t v = 0; v < M; v++) {
+                        for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
+                            syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v]);
                             syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip;
                             PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip);
                         }

crypto_kem/ledakemlt52/leaktime/dfr_test.c

@@ -14,47 +14,49 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_
     unsigned int maxMut[N0], maxMutMinusOne[N0];
     unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne;
     unsigned int gammaHist[N0][DV * M + 1] = {{0}};
+    unsigned int toAdd;
+    size_t histIdx;
 
-    for (int i = 0; i < N0; i++) {
-        for (int j = 0; j < DV * M; j++) {
+    for (size_t i = 0; i < N0; i++) {
+        for (size_t j = 0; j < DV * M; j++) {
             if (LSparse[i][j] != 0) {
-                LSparse_loc[i][j] = (P - LSparse[i][j]) ;
+                LSparse_loc[i][j] = (P - LSparse[i][j]);
             }
         }
         PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M);
     }
 
 
-    for (int i = 0; i < N0; i++ ) {
-        for (int j = 0; j < N0; j++ ) {
-            for (int k = 0; k < (DV * M); k++) {
-                for (int l = 0; l < (DV * M); l++) {
-                    gamma[i][j][ (P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P ]++;
+    for (size_t i = 0; i < N0; i++ ) {
+        for (size_t j = 0; j < N0; j++) {
+            for (size_t k = 0; k < (DV * M); k++) {
+                for (size_t l = 0; l < (DV * M); l++) {
+                    gamma[i][j][(P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P]++;
                 }
             }
         }
     }
 
-    for (int i = 0; i < N0; i++ ) {
-        for (int j = 0; j < N0; j++ ) {
+    for (size_t i = 0; i < N0; i++ ) {
+        for (size_t j = 0; j < N0; j++ ) {
             gamma[i][j][0] = 0;
         }
     }
 
     /* build histogram of values in gamma */
-    for (int i = 0; i < N0; i++ ) {
-        for (int j = 0; j < N0; j++ ) {
-            for (int k = 0; k < P; k++) {
+    for (size_t i = 0; i < N0; i++ ) {
+        for (size_t j = 0; j < N0; j++ ) {
+            for (size_t k = 0; k < P; k++) {
                 gammaHist[i][gamma[i][j][k]]++;
             }
         }
     }
 
 
-    for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) {
-        unsigned int toAdd = T_BAR - 1;
+    for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) {
         maxMutMinusOne[gammaBlockRowIdx] = 0;
-        unsigned int histIdx = DV * M;
+        histIdx = DV * M;
+        toAdd = T_BAR - 1;
         while ( (histIdx > 0) && (toAdd > 0)) {
             if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) {
                 maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd;
@@ -71,7 +73,7 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_
     /*seek max values across all gamma blocks */
     allBlockMaxSumst = maxMut[0];
     allBlockMaxSumstMinusOne = maxMutMinusOne[0];
-    for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) {
+    for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) {
         allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ?
                            maxMut[gammaBlockRowIdx] :
                            allBlockMaxSumst;

crypto_kem/ledakemlt52/leaktime/gf2x_arith.c

@@ -52,7 +52,7 @@ static void gf2x_mul1(DIGIT *R, const DIGIT A, const DIGIT B) {
 
     R[0] = 0;
     R[1] = (A & 1) * B;
-    for (unsigned i = 1; i < DIGIT_SIZE_b; i++) {
+    for (uint8_t i = 1; i < DIGIT_SIZE_b; i++) {
         tmp = ((A >> i) & 1) * B;
         R[1] ^= tmp << i;
         R[0] ^= tmp >> (DIGIT_SIZE_b - i);

crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.c

@@ -5,39 +5,39 @@
 #include <string.h>  // memcpy(...), memset(...)
 
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) {
-    for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) {
+    for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
         dest[i] = in[i];
     }
 }
 
 /* returns the coefficient of the x^exponent term as the LSB of a digit */
-DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) {
-    unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
-    unsigned int digitIdx = straightIdx / DIGIT_SIZE_b;
-    unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b;
+DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent) {
+    size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
+    size_t digitIdx = straightIdx / DIGIT_SIZE_b;
+    size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
     return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ;
 }
 
 /* sets the coefficient of the x^exponent term as the LSB of a digit */
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) {
-    unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
-    unsigned int digitIdx = straightIdx / DIGIT_SIZE_b;
-    unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b;
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value) {
+    size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
+    size_t digitIdx = straightIdx / DIGIT_SIZE_b;
+    size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
 
     /* clear given coefficient */
-    DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
+    DIGIT mask = ~(((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
     poly[digitIdx] = poly[digitIdx] & mask;
-    poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx));
+    poly[digitIdx] = poly[digitIdx] | ((value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx));
 }
 
 /* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) {
-    unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
-    unsigned int digitIdx = straightIdx / DIGIT_SIZE_b;
-    unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b;
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent) {
+    size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
+    size_t digitIdx = straightIdx / DIGIT_SIZE_b;
+    size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
 
     /* clear given coefficient */
-    DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
+    DIGIT mask = (((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
     poly[digitIdx] = poly[digitIdx] ^ mask;
 }
 
@@ -51,7 +51,7 @@ static int popcount_uint64t(uint64_t x) {
 }
 
 /* population count for a single polynomial */
-int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(DIGIT *poly) {
+int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(const DIGIT *poly) {
     int ret = 0;
     for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) {
         ret += popcount_uint64t(poly[i]);
@@ -74,10 +74,9 @@ static void gf2x_mod(DIGIT out[],  const DIGIT in[]) {
     out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1;
 }
 
-static void right_bit_shift(unsigned int length, DIGIT in[]) {
-
-    unsigned int j;
-    for (j = length - 1; j > 0 ; j--) {
+static void right_bit_shift(size_t length, DIGIT in[]) {
+    size_t j;
+    for (j = length - 1; j > 0; j--) {
         in[j] >>= 1;
         in[j] |=  (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1);
     }
@@ -86,8 +85,8 @@ static void right_bit_shift(unsigned int length, DIGIT in[]) {
 
 
 /* shifts by whole digits */
-static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) {
-    unsigned int j;
+static void left_DIGIT_shift_n(size_t length, DIGIT in[], size_t amount) {
+    size_t j;
     for (j = 0; (j + amount) < length; j++) {
         in[j] = in[j + amount];
     }
@@ -97,7 +96,7 @@ static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amo
 }
 
 /* may shift by an arbitrary amount*/
-static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) {
+static void left_bit_shift_wide_n(size_t length, DIGIT in[], size_t amount) {
     left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b);
     PQCLEAN_LEDAKEMLT52_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b);
 }
@@ -123,18 +122,22 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) {
 
     DIGIT mask = (DIGIT)0x1;
     DIGIT rev1, rev2, a00;
-    int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P;
+    int slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P;
 
     a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask;
     right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A);
 
-    for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) {
+    for (size_t i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) {
         rev1 = reverse_digit(A[i]);
         rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]);
         A[i] = rev2;
         A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1;
     }
 
+    if (NUM_DIGITS_GF2X_ELEMENT % 2 == 1) {
+        A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]);
+    }
+
     if (slack_bits_amount) {
         PQCLEAN_LEDAKEMLT52_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount);
     }
@@ -151,10 +154,9 @@ static void rotate_bit_right(DIGIT in[]) { /*  x^{-1} * in(x) mod x^P+1 */
 }
 
 /* cond swap: swaps digits A and B if swap_mask == -1 */
-static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) {
-    int i;
+static void gf2x_cswap(DIGIT *a, DIGIT *b, int32_t swap_mask) {
     DIGIT t;
-    for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
+    for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
         t = swap_mask & (a[i] ^ b[i]);
         a[i] ^= t;
         b[i] ^= t;
@@ -162,18 +164,18 @@ static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) {
 }
 
 /* returns -1 mask if x != 0, otherwise 0 */
-static inline int nonzero(DIGIT x) {
+static inline int32_t nonzero(DIGIT x) {
     DIGIT t = x;
     t = (~t) + 1;
     t >>= DIGIT_SIZE_b - 1;
-    return -((int)t);
+    return -((int32_t)t);
 }
 
 /* returns -1 mask if x < 0 else 0 */
-static inline int negative(int x) {
+static inline int32_t negative(int x) {
     uint32_t u = x;
     u >>= 31;
-    return -((int)u);
+    return -((int32_t)u);
 }
 
 /* return f(0) as digit */
@@ -191,7 +193,7 @@ static void gf2x_mult_scalar_acc(DIGIT *f, const DIGIT *g, const DIGIT s) {
 
 /* constant-time inverse, source: gcd.cr.yp.to */
 int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) {
-    int i, loop, swap, delta = 1;
+    int32_t swap, delta = 1;
     DIGIT g0_mask;
 
     DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1
@@ -202,17 +204,17 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[])
     f[NUM_DIGITS_GF2X_MODULUS - 1] = 1;
     f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS);
 
-    for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
+    for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
         g[i] = in[i];
     }
 
-    for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
+    for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
         v[i] = 0;
     }
 
     r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1;
 
-    for (loop = 0; loop < 2 * P - 1; ++loop) {
+    for (int loop = 0; loop < 2 * P - 1; ++loop) {
 
         swap = negative(-delta) & nonzero(lsb(g));              // swap = -1 if -delta < 0 AND g(0) != 0
         delta ^= swap & (delta ^ -delta);                       // cond swap delta with -delta if swap
@@ -247,7 +249,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], con
 /*PRE: the representation of the sparse coefficients is sorted in increasing
  order of the coefficients themselves */
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[],
-        POSITION_T sparse[], unsigned int nPos) {
+        POSITION_T sparse[], size_t nPos) {
 
     DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00};
     DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00};
@@ -258,7 +260,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons
         left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]);
         left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]);
 
-        for (unsigned int i = 1; i < nPos; i++) {
+        for (size_t i = 1; i < nPos; i++) {
             if (sparse[i] != INVALID_POS_VALUE) {
                 left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) );
                 PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT);
@@ -270,10 +272,9 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons
 
 }
 
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) {
-
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]) {
     POSITION_T t;
-    int i = 0, j;
+    size_t i = 0, j;
 
     if (A[i] == 0) {
         i = 1;
@@ -297,6 +298,9 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
         size_t sizeB, const POSITION_T B[]) {
 
     POSITION_T prod;
+    POSITION_T lastReadPos;
+    size_t duplicateCount;
+    size_t write_idx, read_idx;
 
     /* compute all the coefficients, filling invalid positions with P*/
     size_t lastFilledPos = 0;
@@ -317,12 +321,11 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
         Res[lastFilledPos] = INVALID_POS_VALUE;
         lastFilledPos++;
     }
+
     PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(Res, sizeR);
+
     /* eliminate duplicates */
-    POSITION_T lastReadPos = Res[0];
-    size_t duplicateCount;
-    size_t write_idx = 0;
-    size_t read_idx = 0;
+    write_idx = read_idx = 0;
     while (read_idx < sizeR  && Res[read_idx] != INVALID_POS_VALUE) {
         lastReadPos = Res[read_idx];
         read_idx++;
@@ -344,13 +347,12 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
 
 /* the implementation is safe even in case A or B alias with the result
  * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(
-    int sizeR, POSITION_T Res[],
-    int sizeA, const POSITION_T A[],
-    int sizeB, const POSITION_T B[]) {
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[],
+        size_t sizeA, const POSITION_T A[],
+        size_t sizeB, const POSITION_T B[]) {
 
     POSITION_T tmpRes[DV * M];
-    int idxA = 0, idxB = 0, idxR = 0;
+    size_t idxA = 0, idxB = 0, idxR = 0;
     while ( idxA < sizeA  &&
             idxB < sizeB  &&
             A[idxA] != INVALID_POS_VALUE &&
@@ -419,18 +421,18 @@ static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct
 /* Obtains fresh randomness and seed-expands it until all the required positions
  * for the '1's in the circulant block are obtained */
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones,
-        int countOnes,
+        size_t countOnes,
         AES_XOF_struct *seed_expander_ctx) {
 
-    int duplicated, placedOnes = 0;
-    uint32_t p;
+    size_t duplicated, placedOnes = 0;
+    POSITION_T p;
 
     while (placedOnes < countOnes) {
         p = rand_range(NUM_BITS_GF2X_ELEMENT,
                        P_BITS,
                        seed_expander_ctx);
         duplicated = 0;
-        for (int j = 0; j < placedOnes; j++) {
+        for (size_t j = 0; j < placedOnes; j++) {
             if (pos_ones[j] == p) {
                 duplicated = 1;
             }

crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.h

@@ -16,22 +16,22 @@
 #define P_BITS                                  (18)
 
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]);
-DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent);
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value);
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent);
-int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(DIGIT *poly);
+DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent);
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value);
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent);
+int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(const DIGIT *poly);
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]);
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]);
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]);
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx);
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, size_t countOnes, AES_XOF_struct *seed_expander_ctx);
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx);
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx);
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]);
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]);
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]);
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]);
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]);
 int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]);
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA,  const POSITION_T A[], size_t sizeB, const POSITION_T B[]);
-void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos);
+void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], size_t nPos);
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly);
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes);
 

crypto_kem/ledakemlt52/leaktime/kem.c

@@ -107,18 +107,19 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
     uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH];
     uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0};
     uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0};
+    int decode_ok, decrypt_ok, equal;
 
     unpack_ct(syndrome, ct);
 
-    int decode_ok = PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(decoded_error_vector,
-                    (const privateKeyNiederreiter_t *)sk, syndrome);
+    decode_ok = PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(decoded_error_vector,
+                (const privateKeyNiederreiter_t *)sk, syndrome);
 
     pack_error(decoded_error_bytes, decoded_error_vector);
     HASH_FUNCTION(hashedErrorVector, decoded_error_bytes, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
 
     memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH);
 
-    for (int i = 0; i < TRNG_BYTE_LENGTH; ++i) {
+    for (size_t i = 0; i < TRNG_BYTE_LENGTH; ++i) {
         decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^
                           hashedAndTruncatedErrorVector[i];
     }
@@ -135,11 +136,11 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
 
     PQCLEAN_LEDAKEMLT52_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos);
 
-    int equal = PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_verify(decoded_error_vector,
-                reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT);
+    equal = PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_verify(decoded_error_vector,
+            reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT);
     // equal == 0, if the reconstructed error vector match !!!
 
-    int decryptOk = (decode_ok == 1 && equal == 0);
+    decrypt_ok = (decode_ok == 1 && equal == 0);
 
     memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH);
     memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH);
@@ -148,7 +149,7 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
     PQCLEAN_LEDAKEMLT52_LEAKTIME_cmov(ss_input + sizeof(decoded_seed),
                                       ((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret,
                                       TRNG_BYTE_LENGTH,
-                                      !decryptOk);
+                                      !decrypt_ok);
 
     HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH);
 

crypto_kem/ledakemlt52/leaktime/niederreiter.c

@@ -49,7 +49,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p
             }
         }
         is_L_full = 1;
-        for (int i = 0; i < N0; i++) {
+        for (size_t i = 0; i < N0; i++) {
             is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE);
         }
         sk->rejections = sk->rejections + 1;
@@ -63,21 +63,21 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p
             sk->decryption_failure_secret,
             (unsigned long)TRNG_BYTE_LENGTH);
 
-    for (int j = 0; j < DV * M; j++) {
+    for (size_t j = 0; j < DV * M; j++) {
         if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) {
             PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1);
         }
     }
 
     PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense);
-    for (int i = 0; i < N0 - 1; i++) {
+    for (size_t i = 0; i < N0 - 1; i++) {
         PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT,
                 Ln0Inv,
                 LPosOnes[i],
                 DV * M);
     }
 
-    for (int i = 0; i < N0 - 1; i++) {
+    for (size_t i = 0; i < N0 - 1; i++) {
         PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT);
     }
 }
@@ -110,24 +110,27 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
     POSITION_T auxSparse[DV * M];
     POSITION_T Ln0trSparse[DV * M];
     DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0};
+    DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B];
     DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT];
-    unsigned char processedQOnes[N0];
+    uint8_t processedQOnes[N0];
     int rejections = sk->rejections;
+    int decrypt_ok = 0;
+    int err_weight;
 
     PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed);
     do {
         PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander);
         PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander);
 
-        for (int i = 0; i < N0; i++) {
-            for (int j = 0; j < DV * M; j++) {
+        for (size_t i = 0; i < N0; i++) {
+            for (size_t j = 0; j < DV * M; j++) {
                 LPosOnes[i][j] = INVALID_POS_VALUE;
             }
         }
 
         memset(processedQOnes, 0x00, sizeof(processedQOnes));
-        for (int colQ = 0; colQ < N0; colQ++) {
-            for (int i = 0; i < N0; i++) {
+        for (size_t colQ = 0; colQ < N0; colQ++) {
+            for (size_t i = 0; i < N0; i++) {
                 PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes,
                         DV, HPosOnes[i],
                         qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]);
@@ -143,15 +146,15 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
     PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes);
     PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes);
 
-    for (int i = 0; i < DV * M; i++) {
+    for (size_t i = 0; i < DV * M; i++) {
         Ln0trSparse[i] = INVALID_POS_VALUE;
         auxSparse[i] = INVALID_POS_VALUE;
     }
 
-    for (int i = 0; i < N0; i++) {
+    for (size_t i = 0; i < N0; i++) {
         PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse,
                 DV, HPosOnes[i],
-                qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1] ] );
+                qBlockWeights[i][N0 - 1], &QPosOnes[i][M - qBlockWeights[i][N0 - 1]]);
         PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse,
                 DV * M, Ln0trSparse,
                 DV * M, auxSparse);
@@ -163,28 +166,27 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
             Ln0trSparse,
             DV * M);
 
-    int decryptOk = 0;
-    decryptOk = PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(err_computed,
-                (const POSITION_T (*)[DV]) HtrPosOnes,
-                (const POSITION_T (*)[M])  QtrPosOnes,
-                privateSyndrome, sk->secondIterThreshold);
+    decrypt_ok = PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(err_computed,
+                 (const POSITION_T (*)[DV]) HtrPosOnes,
+                 (const POSITION_T (*)[M])  QtrPosOnes,
+                 privateSyndrome, sk->secondIterThreshold);
 
-    int err_weight = 0;
-    for (int i = 0 ; i < N0; i++) {
+    err_weight = 0;
+    for (size_t i = 0 ; i < N0; i++) {
         err_weight += PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i));
     }
-    decryptOk = decryptOk && (err_weight == NUM_ERRORS_T);
+    decrypt_ok = decrypt_ok && (err_weight == NUM_ERRORS_T);
 
     /* prepare mockup error vector in case a decoding failure occurs */
-    DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B];
     memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
     memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH);
     memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00,
            (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH);
 
     memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
+
     // Overwrite on decryption failure
-    PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decryptOk);
+    PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decrypt_ok);
 
-    return decryptOk;
+    return decrypt_ok;
 }

crypto_kem/ledakemlt52/leaktime/rng.c

@@ -13,8 +13,8 @@
  maxlen         - maximum number of bytes (less than 2**32) generated under this seed and diversifier
  */
 static void seedexpander_init(AES_XOF_struct *ctx,
-                              unsigned char *seed,
-                              unsigned char *diversifier,
+                              uint8_t *seed,
+                              uint8_t *diversifier,
                               size_t maxlen) {
 
     ctx->length_remaining = maxlen;
@@ -38,13 +38,13 @@ static void seedexpander_init(AES_XOF_struct *ctx,
 }
 
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx,
-        const unsigned char *trng_entropy
+        const uint8_t *trng_entropy
         /* TRNG_BYTE_LENGTH wide buffer */) {
 
     /*the NIST seedexpander will however access 32B from this buffer */
     unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH;
-    unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 };
-    unsigned char *diversifier = ((unsigned char *)trng_entropy) + 32;
+    uint8_t prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = {0x00};
+    uint8_t *diversifier = (uint8_t *)trng_entropy + 32;
 
     memcpy(prng_buffer,
            trng_entropy,
@@ -61,7 +61,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx,
     x    - returns the XOF data
     xlen - number of bytes to return
  */
-int PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) {
+int PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(AES_XOF_struct *ctx, uint8_t *x, size_t xlen) {
     size_t offset;
     aes256ctx ctx256;
 

crypto_kem/ledakemlt52/leaktime/sort.c

@@ -5,6 +5,17 @@
     Source: https://sorting.cr.yp.to
 */
 
+#define int32_MINMAX(a,b) \
+    do { \
+        int32 ab = (b) ^ (a); \
+        int32 c = (b) - (a); \
+        c ^= ab & (c ^ (b)); \
+        c >>= 31; \
+        c &= ab; \
+        (a) ^= c; \
+        (b) ^= c; \
+    } while(0)
+
 static void int32_sort(int32 *x, size_t n) {
     size_t top, p, q, r, i, j;
 

crypto_kem/ledakemlt52/leaktime/sort.h

@@ -6,17 +6,6 @@
 
 #define int32 int32_t
 
-#define int32_MINMAX(a,b) \
-    do { \
-        int32 ab = (b) ^ (a); \
-        int32 c = (b) - (a); \
-        c ^= ab & (c ^ (b)); \
-        c >>= 31; \
-        c &= ab; \
-        (a) ^= c; \
-        (b) ^= c; \
-    } while(0)
-
 void PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(uint32_t *x, size_t n);
 
 #endif

test/duplicate_consistency/ledakemlt12_leaktime.yml

@@ -7,6 +7,7 @@ consistency_checks:
     - dfr_test.c
     - dfr_test.h
     - gf2x_arith.c
+    - gf2x_arith_mod_xPplusOne.c
     - H_Q_matrices_generation.c
     - H_Q_matrices_generation.h
     - kem.c
@@ -24,6 +25,7 @@ consistency_checks:
     - dfr_test.c
     - dfr_test.h
     - gf2x_arith.c
+    - gf2x_arith_mod_xPplusOne.c
     - H_Q_matrices_generation.c
     - H_Q_matrices_generation.h
     - kem.c
@@ -32,4 +34,3 @@ consistency_checks:
     - rng.h
     - utils.c
     - utils.h
-

test/duplicate_consistency/ledakemlt32_leaktime.yml

@@ -7,6 +7,7 @@ consistency_checks:
     - dfr_test.c
     - dfr_test.h
     - gf2x_arith.c
+    - gf2x_arith_mod_xPplusOne.c
     - H_Q_matrices_generation.c
     - H_Q_matrices_generation.h
     - kem.c
@@ -24,6 +25,7 @@ consistency_checks:
     - dfr_test.c
     - dfr_test.h
     - gf2x_arith.c
+    - gf2x_arith_mod_xPplusOne.c
     - H_Q_matrices_generation.c
     - H_Q_matrices_generation.h
     - kem.c
@@ -32,4 +34,3 @@ consistency_checks:
     - rng.h
     - utils.c
     - utils.h
-

test/duplicate_consistency/ledakemlt52_leaktime.yml

@@ -7,6 +7,7 @@ consistency_checks:
     - dfr_test.c
     - dfr_test.h
     - gf2x_arith.c
+    - gf2x_arith_mod_xPplusOne.c
     - H_Q_matrices_generation.c
     - H_Q_matrices_generation.h
     - kem.c
@@ -32,4 +33,3 @@ consistency_checks:
     - rng.h
     - utils.c
     - utils.h
-