@@ -1,23 +1,19 @@ | |||||
#include "H_Q_matrices_generation.h" | #include "H_Q_matrices_generation.h" | ||||
#include "gf2x_arith_mod_xPplusOne.h" | #include "gf2x_arith_mod_xPplusOne.h" | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], | |||||
AES_XOF_struct *keys_expander) { | |||||
for (int i = 0; i < N0; i++) { | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], AES_XOF_struct *keys_expander) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
/* Generate a random block of Htr */ | /* Generate a random block of Htr */ | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], | |||||
DV, | |||||
keys_expander); | |||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], DV, keys_expander); | |||||
} | } | ||||
} | } | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], | |||||
AES_XOF_struct *keys_expander) { | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], AES_XOF_struct *keys_expander) { | |||||
size_t placed_ones; | |||||
for (int i = 0; i < N0; i++) { | |||||
int placed_ones = 0; | |||||
for (int j = 0; j < N0; j++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
placed_ones = 0; | |||||
for (size_t j = 0; j < N0; j++) { | |||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones], | PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones], | ||||
qBlockWeights[i][j], | qBlockWeights[i][j], | ||||
keys_expander); | keys_expander); | ||||
@@ -26,29 +22,27 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], | |||||
} | } | ||||
} | } | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], /* output*/ | |||||
POSITION_T HPosOnes[N0][DV]) { | |||||
for (int i = 0; i < N0; i++) { | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], POSITION_T HPosOnes[N0][DV]) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
/* Obtain directly the sparse representation of the block of H */ | /* Obtain directly the sparse representation of the block of H */ | ||||
for (int k = 0; k < DV; k++) { | |||||
for (size_t k = 0; k < DV; k++) { | |||||
HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */ | HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */ | ||||
}// end for k | |||||
} | |||||
} | } | ||||
} | } | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], /* output*/ | |||||
POSITION_T QPosOnes[N0][M]) { | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], POSITION_T QPosOnes[N0][M]) { | |||||
POSITION_T transposed_ones_idx[N0] = {0x00}; | |||||
size_t currQoneIdx, endQblockIdx; | |||||
unsigned transposed_ones_idx[N0] = {0x00}; | |||||
for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { | |||||
int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] | |||||
int endQblockIdx = 0; | |||||
for (size_t source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { | |||||
currQoneIdx = 0; // position in the column of QtrPosOnes[][...] | |||||
endQblockIdx = 0; | |||||
for (int blockIdx = 0; blockIdx < N0; blockIdx++) { | for (int blockIdx = 0; blockIdx < N0; blockIdx++) { | ||||
endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; | endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; | ||||
for (; currQoneIdx < endQblockIdx; currQoneIdx++) { | for (; currQoneIdx < endQblockIdx; currQoneIdx++) { | ||||
QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P - | |||||
QPosOnes[source_row_idx][currQoneIdx]) % P; | |||||
QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = | |||||
(P - QPosOnes[source_row_idx][currQoneIdx]) % P; | |||||
transposed_ones_idx[blockIdx]++; | transposed_ones_idx[blockIdx]++; | ||||
} | } | ||||
} | } | ||||
@@ -7,22 +7,26 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(DIGIT err[], | |||||
const POSITION_T HtrPosOnes[N0][DV], | const POSITION_T HtrPosOnes[N0][DV], | ||||
const POSITION_T QtrPosOnes[N0][M], | const POSITION_T QtrPosOnes[N0][M], | ||||
DIGIT privateSyndrome[], | DIGIT privateSyndrome[], | ||||
uint8_t threshold) { | |||||
uint8_t secondIterThreshold) { | |||||
DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; | |||||
uint8_t unsatParityChecks[N0 * P]; | uint8_t unsatParityChecks[N0 * P]; | ||||
POSITION_T currQBlkPos[M], currQBitPos[M]; | POSITION_T currQBlkPos[M], currQBitPos[M]; | ||||
DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; | |||||
POSITION_T syndromePosToFlip, tmp; | |||||
unsigned int correlation, corrt_syndrome_based; | |||||
size_t currQoneIdx, endQblockIdx, currblockoffset; | |||||
int check; | int check; | ||||
int iteration = 0; | int iteration = 0; | ||||
unsigned int corrt_syndrome_based; | |||||
do { | do { | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); | PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); | ||||
memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); | memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); | ||||
for (int i = 0; i < N0; i++) { | |||||
for (int valueIdx = 0; valueIdx < P; valueIdx++) { | |||||
for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { | |||||
POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx); | |||||
for (size_t i = 0; i < N0; i++) { | |||||
for (size_t valueIdx = 0; valueIdx < P; valueIdx++) { | |||||
for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { | |||||
tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? | |||||
(HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : | |||||
(HtrPosOnes[i][HtrOneIdx] + valueIdx); | |||||
if (PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { | if (PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { | ||||
unsatParityChecks[i * P + valueIdx]++; | unsatParityChecks[i * P + valueIdx]++; | ||||
} | } | ||||
@@ -31,33 +35,32 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(DIGIT err[], | |||||
} | } | ||||
/* iteration based threshold determination*/ | /* iteration based threshold determination*/ | ||||
corrt_syndrome_based = iteration ? (unsigned int) threshold : B0; | |||||
corrt_syndrome_based = iteration * secondIterThreshold + (1 - iteration) * B0; | |||||
//Computation of correlation with a full Q matrix | |||||
for (int i = 0; i < N0; i++) { | |||||
for (int j = 0; j < P; j++) { | |||||
int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] | |||||
int endQblockIdx = 0; | |||||
unsigned int correlation = 0; | |||||
// Computation of correlation with a full Q matrix | |||||
for (size_t i = 0; i < N0; i++) { | |||||
for (size_t j = 0; j < P; j++) { | |||||
currQoneIdx = endQblockIdx = 0; | |||||
correlation = 0; | |||||
for (int blockIdx = 0; blockIdx < N0; blockIdx++) { | |||||
for (size_t blockIdx = 0; blockIdx < N0; blockIdx++) { | |||||
endQblockIdx += qBlockWeights[blockIdx][i]; | endQblockIdx += qBlockWeights[blockIdx][i]; | ||||
int currblockoffset = blockIdx * P; | |||||
currblockoffset = blockIdx * P; | |||||
for (; currQoneIdx < endQblockIdx; currQoneIdx++) { | for (; currQoneIdx < endQblockIdx; currQoneIdx++) { | ||||
POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j; | |||||
tmp = QtrPosOnes[i][currQoneIdx] + j; | |||||
tmp = tmp >= P ? tmp - P : tmp; | tmp = tmp >= P ? tmp - P : tmp; | ||||
currQBitPos[currQoneIdx] = tmp; | currQBitPos[currQoneIdx] = tmp; | ||||
currQBlkPos[currQoneIdx] = blockIdx; | currQBlkPos[currQoneIdx] = blockIdx; | ||||
correlation += unsatParityChecks[tmp + currblockoffset]; | correlation += unsatParityChecks[tmp + currblockoffset]; | ||||
} | } | ||||
} | } | ||||
/* Correlation based flipping */ | /* Correlation based flipping */ | ||||
if (correlation >= corrt_syndrome_based) { | if (correlation >= corrt_syndrome_based) { | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); | PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); | ||||
for (int v = 0; v < M; v++) { | |||||
POSITION_T syndromePosToFlip; | |||||
for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { | |||||
syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] ); | |||||
for (size_t v = 0; v < M; v++) { | |||||
for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { | |||||
syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v]); | |||||
syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; | syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); | PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); | ||||
} | } | ||||
@@ -14,47 +14,49 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_ | |||||
unsigned int maxMut[N0], maxMutMinusOne[N0]; | unsigned int maxMut[N0], maxMutMinusOne[N0]; | ||||
unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; | unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; | ||||
unsigned int gammaHist[N0][DV * M + 1] = {{0}}; | unsigned int gammaHist[N0][DV * M + 1] = {{0}}; | ||||
unsigned int toAdd; | |||||
size_t histIdx; | |||||
for (int i = 0; i < N0; i++) { | |||||
for (int j = 0; j < DV * M; j++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
for (size_t j = 0; j < DV * M; j++) { | |||||
if (LSparse[i][j] != 0) { | if (LSparse[i][j] != 0) { | ||||
LSparse_loc[i][j] = (P - LSparse[i][j]) ; | |||||
LSparse_loc[i][j] = (P - LSparse[i][j]); | |||||
} | } | ||||
} | } | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M); | PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M); | ||||
} | } | ||||
for (int i = 0; i < N0; i++ ) { | |||||
for (int j = 0; j < N0; j++ ) { | |||||
for (int k = 0; k < (DV * M); k++) { | |||||
for (int l = 0; l < (DV * M); l++) { | |||||
gamma[i][j][ (P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P ]++; | |||||
for (size_t i = 0; i < N0; i++ ) { | |||||
for (size_t j = 0; j < N0; j++) { | |||||
for (size_t k = 0; k < (DV * M); k++) { | |||||
for (size_t l = 0; l < (DV * M); l++) { | |||||
gamma[i][j][(P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P]++; | |||||
} | } | ||||
} | } | ||||
} | } | ||||
} | } | ||||
for (int i = 0; i < N0; i++ ) { | |||||
for (int j = 0; j < N0; j++ ) { | |||||
for (size_t i = 0; i < N0; i++ ) { | |||||
for (size_t j = 0; j < N0; j++ ) { | |||||
gamma[i][j][0] = 0; | gamma[i][j][0] = 0; | ||||
} | } | ||||
} | } | ||||
/* build histogram of values in gamma */ | /* build histogram of values in gamma */ | ||||
for (int i = 0; i < N0; i++ ) { | |||||
for (int j = 0; j < N0; j++ ) { | |||||
for (int k = 0; k < P; k++) { | |||||
for (size_t i = 0; i < N0; i++ ) { | |||||
for (size_t j = 0; j < N0; j++ ) { | |||||
for (size_t k = 0; k < P; k++) { | |||||
gammaHist[i][gamma[i][j][k]]++; | gammaHist[i][gamma[i][j][k]]++; | ||||
} | } | ||||
} | } | ||||
} | } | ||||
for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { | |||||
unsigned int toAdd = T_BAR - 1; | |||||
for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { | |||||
maxMutMinusOne[gammaBlockRowIdx] = 0; | maxMutMinusOne[gammaBlockRowIdx] = 0; | ||||
unsigned int histIdx = DV * M; | |||||
histIdx = DV * M; | |||||
toAdd = T_BAR - 1; | |||||
while ( (histIdx > 0) && (toAdd > 0)) { | while ( (histIdx > 0) && (toAdd > 0)) { | ||||
if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { | if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { | ||||
maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; | maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; | ||||
@@ -71,7 +73,7 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_ | |||||
/*seek max values across all gamma blocks */ | /*seek max values across all gamma blocks */ | ||||
allBlockMaxSumst = maxMut[0]; | allBlockMaxSumst = maxMut[0]; | ||||
allBlockMaxSumstMinusOne = maxMutMinusOne[0]; | allBlockMaxSumstMinusOne = maxMutMinusOne[0]; | ||||
for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { | |||||
for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { | |||||
allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? | allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? | ||||
maxMut[gammaBlockRowIdx] : | maxMut[gammaBlockRowIdx] : | ||||
allBlockMaxSumst; | allBlockMaxSumst; | ||||
@@ -52,7 +52,7 @@ static void gf2x_mul1(DIGIT *R, const DIGIT A, const DIGIT B) { | |||||
R[0] = 0; | R[0] = 0; | ||||
R[1] = (A & 1) * B; | R[1] = (A & 1) * B; | ||||
for (unsigned i = 1; i < DIGIT_SIZE_b; i++) { | |||||
for (uint8_t i = 1; i < DIGIT_SIZE_b; i++) { | |||||
tmp = ((A >> i) & 1) * B; | tmp = ((A >> i) & 1) * B; | ||||
R[1] ^= tmp << i; | R[1] ^= tmp << i; | ||||
R[0] ^= tmp >> (DIGIT_SIZE_b - i); | R[0] ^= tmp >> (DIGIT_SIZE_b - i); | ||||
@@ -5,39 +5,39 @@ | |||||
#include <string.h> // memcpy(...), memset(...) | #include <string.h> // memcpy(...), memset(...) | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { | void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { | ||||
for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { | |||||
for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
dest[i] = in[i]; | dest[i] = in[i]; | ||||
} | } | ||||
} | } | ||||
/* returns the coefficient of the x^exponent term as the LSB of a digit */ | /* returns the coefficient of the x^exponent term as the LSB of a digit */ | ||||
DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) { | |||||
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent) { | |||||
size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
size_t digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; | return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; | ||||
} | } | ||||
/* sets the coefficient of the x^exponent term as the LSB of a digit */ | /* sets the coefficient of the x^exponent term as the LSB of a digit */ | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) { | |||||
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value) { | |||||
size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
size_t digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
/* clear given coefficient */ | /* clear given coefficient */ | ||||
DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
DIGIT mask = ~(((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
poly[digitIdx] = poly[digitIdx] & mask; | poly[digitIdx] = poly[digitIdx] & mask; | ||||
poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
poly[digitIdx] = poly[digitIdx] | ((value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
} | } | ||||
/* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ | /* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) { | |||||
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent) { | |||||
size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
size_t digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
/* clear given coefficient */ | /* clear given coefficient */ | ||||
DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
DIGIT mask = (((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
poly[digitIdx] = poly[digitIdx] ^ mask; | poly[digitIdx] = poly[digitIdx] ^ mask; | ||||
} | } | ||||
@@ -51,7 +51,7 @@ static int popcount_uint64t(uint64_t x) { | |||||
} | } | ||||
/* population count for a single polynomial */ | /* population count for a single polynomial */ | ||||
int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(DIGIT *poly) { | |||||
int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(const DIGIT *poly) { | |||||
int ret = 0; | int ret = 0; | ||||
for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { | for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { | ||||
ret += popcount_uint64t(poly[i]); | ret += popcount_uint64t(poly[i]); | ||||
@@ -74,10 +74,9 @@ static void gf2x_mod(DIGIT out[], const DIGIT in[]) { | |||||
out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1; | out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1; | ||||
} | } | ||||
static void right_bit_shift(unsigned int length, DIGIT in[]) { | |||||
unsigned int j; | |||||
for (j = length - 1; j > 0 ; j--) { | |||||
static void right_bit_shift(size_t length, DIGIT in[]) { | |||||
size_t j; | |||||
for (j = length - 1; j > 0; j--) { | |||||
in[j] >>= 1; | in[j] >>= 1; | ||||
in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); | in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); | ||||
} | } | ||||
@@ -86,8 +85,8 @@ static void right_bit_shift(unsigned int length, DIGIT in[]) { | |||||
/* shifts by whole digits */ | /* shifts by whole digits */ | ||||
static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) { | |||||
unsigned int j; | |||||
static void left_DIGIT_shift_n(size_t length, DIGIT in[], size_t amount) { | |||||
size_t j; | |||||
for (j = 0; (j + amount) < length; j++) { | for (j = 0; (j + amount) < length; j++) { | ||||
in[j] = in[j + amount]; | in[j] = in[j + amount]; | ||||
} | } | ||||
@@ -97,7 +96,7 @@ static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amo | |||||
} | } | ||||
/* may shift by an arbitrary amount*/ | /* may shift by an arbitrary amount*/ | ||||
static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) { | |||||
static void left_bit_shift_wide_n(size_t length, DIGIT in[], size_t amount) { | |||||
left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); | left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); | PQCLEAN_LEDAKEMLT12_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); | ||||
} | } | ||||
@@ -123,19 +122,21 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) { | |||||
DIGIT mask = (DIGIT)0x1; | DIGIT mask = (DIGIT)0x1; | ||||
DIGIT rev1, rev2, a00; | DIGIT rev1, rev2, a00; | ||||
int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; | |||||
int slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; | |||||
a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; | a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; | ||||
right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); | right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); | ||||
for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { | |||||
for (size_t i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { | |||||
rev1 = reverse_digit(A[i]); | rev1 = reverse_digit(A[i]); | ||||
rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); | rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); | ||||
A[i] = rev2; | A[i] = rev2; | ||||
A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; | A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; | ||||
} | } | ||||
A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]); | |||||
if (NUM_DIGITS_GF2X_ELEMENT % 2 == 1) { | |||||
A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]); | |||||
} | |||||
if (slack_bits_amount) { | if (slack_bits_amount) { | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); | PQCLEAN_LEDAKEMLT12_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); | ||||
@@ -153,10 +154,9 @@ static void rotate_bit_right(DIGIT in[]) { /* x^{-1} * in(x) mod x^P+1 */ | |||||
} | } | ||||
/* cond swap: swaps digits A and B if swap_mask == -1 */ | /* cond swap: swaps digits A and B if swap_mask == -1 */ | ||||
static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { | |||||
int i; | |||||
static void gf2x_cswap(DIGIT *a, DIGIT *b, int32_t swap_mask) { | |||||
DIGIT t; | DIGIT t; | ||||
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
t = swap_mask & (a[i] ^ b[i]); | t = swap_mask & (a[i] ^ b[i]); | ||||
a[i] ^= t; | a[i] ^= t; | ||||
b[i] ^= t; | b[i] ^= t; | ||||
@@ -164,18 +164,18 @@ static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { | |||||
} | } | ||||
/* returns -1 mask if x != 0, otherwise 0 */ | /* returns -1 mask if x != 0, otherwise 0 */ | ||||
static inline int nonzero(DIGIT x) { | |||||
static inline int32_t nonzero(DIGIT x) { | |||||
DIGIT t = x; | DIGIT t = x; | ||||
t = (~t) + 1; | t = (~t) + 1; | ||||
t >>= DIGIT_SIZE_b - 1; | t >>= DIGIT_SIZE_b - 1; | ||||
return -((int)t); | |||||
return -((int32_t)t); | |||||
} | } | ||||
/* returns -1 mask if x < 0 else 0 */ | /* returns -1 mask if x < 0 else 0 */ | ||||
static inline int negative(int x) { | |||||
static inline int32_t negative(int x) { | |||||
uint32_t u = x; | uint32_t u = x; | ||||
u >>= 31; | u >>= 31; | ||||
return -((int)u); | |||||
return -((int32_t)u); | |||||
} | } | ||||
/* return f(0) as digit */ | /* return f(0) as digit */ | ||||
@@ -193,7 +193,7 @@ static void gf2x_mult_scalar_acc(DIGIT *f, const DIGIT *g, const DIGIT s) { | |||||
/* constant-time inverse, source: gcd.cr.yp.to */ | /* constant-time inverse, source: gcd.cr.yp.to */ | ||||
int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { | int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { | ||||
int i, loop, swap, delta = 1; | |||||
int32_t swap, delta = 1; | |||||
DIGIT g0_mask; | DIGIT g0_mask; | ||||
DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1 | DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1 | ||||
@@ -204,17 +204,17 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) | |||||
f[NUM_DIGITS_GF2X_MODULUS - 1] = 1; | f[NUM_DIGITS_GF2X_MODULUS - 1] = 1; | ||||
f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); | f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); | ||||
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
g[i] = in[i]; | g[i] = in[i]; | ||||
} | } | ||||
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
v[i] = 0; | v[i] = 0; | ||||
} | } | ||||
r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1; | r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1; | ||||
for (loop = 0; loop < 2 * P - 1; ++loop) { | |||||
for (int loop = 0; loop < 2 * P - 1; ++loop) { | |||||
swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0 | swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0 | ||||
delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap | delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap | ||||
@@ -249,7 +249,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], con | |||||
/*PRE: the representation of the sparse coefficients is sorted in increasing | /*PRE: the representation of the sparse coefficients is sorted in increasing | ||||
order of the coefficients themselves */ | order of the coefficients themselves */ | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], | void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], | ||||
POSITION_T sparse[], unsigned int nPos) { | |||||
POSITION_T sparse[], size_t nPos) { | |||||
DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; | DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; | ||||
DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; | DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; | ||||
@@ -260,7 +260,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons | |||||
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); | left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); | ||||
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); | left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); | ||||
for (unsigned int i = 1; i < nPos; i++) { | |||||
for (size_t i = 1; i < nPos; i++) { | |||||
if (sparse[i] != INVALID_POS_VALUE) { | if (sparse[i] != INVALID_POS_VALUE) { | ||||
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); | left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); | PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); | ||||
@@ -272,10 +272,9 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons | |||||
} | } | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) { | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]) { | |||||
POSITION_T t; | POSITION_T t; | ||||
int i = 0, j; | |||||
size_t i = 0, j; | |||||
if (A[i] == 0) { | if (A[i] == 0) { | ||||
i = 1; | i = 1; | ||||
@@ -299,6 +298,9 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R | |||||
size_t sizeB, const POSITION_T B[]) { | size_t sizeB, const POSITION_T B[]) { | ||||
POSITION_T prod; | POSITION_T prod; | ||||
POSITION_T lastReadPos; | |||||
size_t duplicateCount; | |||||
size_t write_idx, read_idx; | |||||
/* compute all the coefficients, filling invalid positions with P*/ | /* compute all the coefficients, filling invalid positions with P*/ | ||||
size_t lastFilledPos = 0; | size_t lastFilledPos = 0; | ||||
@@ -319,12 +321,11 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R | |||||
Res[lastFilledPos] = INVALID_POS_VALUE; | Res[lastFilledPos] = INVALID_POS_VALUE; | ||||
lastFilledPos++; | lastFilledPos++; | ||||
} | } | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(Res, sizeR); | PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(Res, sizeR); | ||||
/* eliminate duplicates */ | /* eliminate duplicates */ | ||||
POSITION_T lastReadPos = Res[0]; | |||||
size_t duplicateCount; | |||||
size_t write_idx = 0; | |||||
size_t read_idx = 0; | |||||
write_idx = read_idx = 0; | |||||
while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { | while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { | ||||
lastReadPos = Res[read_idx]; | lastReadPos = Res[read_idx]; | ||||
read_idx++; | read_idx++; | ||||
@@ -346,13 +347,12 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R | |||||
/* the implementation is safe even in case A or B alias with the result | /* the implementation is safe even in case A or B alias with the result | ||||
* PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ | * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse( | |||||
int sizeR, POSITION_T Res[], | |||||
int sizeA, const POSITION_T A[], | |||||
int sizeB, const POSITION_T B[]) { | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], | |||||
size_t sizeA, const POSITION_T A[], | |||||
size_t sizeB, const POSITION_T B[]) { | |||||
POSITION_T tmpRes[DV * M]; | POSITION_T tmpRes[DV * M]; | ||||
int idxA = 0, idxB = 0, idxR = 0; | |||||
size_t idxA = 0, idxB = 0, idxR = 0; | |||||
while ( idxA < sizeA && | while ( idxA < sizeA && | ||||
idxB < sizeB && | idxB < sizeB && | ||||
A[idxA] != INVALID_POS_VALUE && | A[idxA] != INVALID_POS_VALUE && | ||||
@@ -421,18 +421,18 @@ static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct | |||||
/* Obtains fresh randomness and seed-expands it until all the required positions | /* Obtains fresh randomness and seed-expands it until all the required positions | ||||
* for the '1's in the circulant block are obtained */ | * for the '1's in the circulant block are obtained */ | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, | void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, | ||||
int countOnes, | |||||
size_t countOnes, | |||||
AES_XOF_struct *seed_expander_ctx) { | AES_XOF_struct *seed_expander_ctx) { | ||||
int duplicated, placedOnes = 0; | |||||
uint32_t p; | |||||
size_t duplicated, placedOnes = 0; | |||||
POSITION_T p; | |||||
while (placedOnes < countOnes) { | while (placedOnes < countOnes) { | ||||
p = rand_range(NUM_BITS_GF2X_ELEMENT, | p = rand_range(NUM_BITS_GF2X_ELEMENT, | ||||
P_BITS, | P_BITS, | ||||
seed_expander_ctx); | seed_expander_ctx); | ||||
duplicated = 0; | duplicated = 0; | ||||
for (int j = 0; j < placedOnes; j++) { | |||||
for (size_t j = 0; j < placedOnes; j++) { | |||||
if (pos_ones[j] == p) { | if (pos_ones[j] == p) { | ||||
duplicated = 1; | duplicated = 1; | ||||
} | } | ||||
@@ -16,22 +16,22 @@ | |||||
#define P_BITS (16) // log_2(p) = 15.6703 | #define P_BITS (16) // log_2(p) = 15.6703 | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); | void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); | ||||
DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent); | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value); | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent); | |||||
int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(DIGIT *poly); | |||||
DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent); | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value); | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent); | |||||
int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(const DIGIT *poly); | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); | void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); | void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); | void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx); | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, size_t countOnes, AES_XOF_struct *seed_expander_ctx); | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); | void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx); | void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx); | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]); | void PQCLEAN_LEDAKEMLT12_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]); | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]); | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]); | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]); | |||||
int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); | int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); | void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos); | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], size_t nPos); | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); | void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); | void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); | ||||
@@ -107,18 +107,19 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, | |||||
uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH]; | uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH]; | ||||
uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0}; | uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0}; | ||||
uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0}; | uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0}; | ||||
int decode_ok, decrypt_ok, equal; | |||||
unpack_ct(syndrome, ct); | unpack_ct(syndrome, ct); | ||||
int decode_ok = PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(decoded_error_vector, | |||||
(const privateKeyNiederreiter_t *)sk, syndrome); | |||||
decode_ok = PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(decoded_error_vector, | |||||
(const privateKeyNiederreiter_t *)sk, syndrome); | |||||
pack_error(decoded_error_bytes, decoded_error_vector); | pack_error(decoded_error_bytes, decoded_error_vector); | ||||
HASH_FUNCTION(hashedErrorVector, decoded_error_bytes, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | HASH_FUNCTION(hashedErrorVector, decoded_error_bytes, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | ||||
memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH); | memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH); | ||||
for (int i = 0; i < TRNG_BYTE_LENGTH; ++i) { | |||||
for (size_t i = 0; i < TRNG_BYTE_LENGTH; ++i) { | |||||
decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^ | decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^ | ||||
hashedAndTruncatedErrorVector[i]; | hashedAndTruncatedErrorVector[i]; | ||||
} | } | ||||
@@ -135,11 +136,11 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, | |||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos); | PQCLEAN_LEDAKEMLT12_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos); | ||||
int equal = PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_verify(decoded_error_vector, | |||||
reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); | |||||
equal = PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_verify(decoded_error_vector, | |||||
reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); | |||||
// equal == 0, if the reconstructed error vector match !!! | // equal == 0, if the reconstructed error vector match !!! | ||||
int decryptOk = (decode_ok == 1 && equal == 0); | |||||
decrypt_ok = (decode_ok == 1 && equal == 0); | |||||
memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH); | memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH); | ||||
memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH); | memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH); | ||||
@@ -148,7 +149,7 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, | |||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_cmov(ss_input + sizeof(decoded_seed), | PQCLEAN_LEDAKEMLT12_LEAKTIME_cmov(ss_input + sizeof(decoded_seed), | ||||
((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret, | ((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret, | ||||
TRNG_BYTE_LENGTH, | TRNG_BYTE_LENGTH, | ||||
!decryptOk); | |||||
!decrypt_ok); | |||||
HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH); | HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH); | ||||
@@ -49,7 +49,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p | |||||
} | } | ||||
} | } | ||||
is_L_full = 1; | is_L_full = 1; | ||||
for (int i = 0; i < N0; i++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); | is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); | ||||
} | } | ||||
sk->rejections = sk->rejections + 1; | sk->rejections = sk->rejections + 1; | ||||
@@ -63,21 +63,21 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p | |||||
sk->decryption_failure_secret, | sk->decryption_failure_secret, | ||||
(unsigned long)TRNG_BYTE_LENGTH); | (unsigned long)TRNG_BYTE_LENGTH); | ||||
for (int j = 0; j < DV * M; j++) { | |||||
for (size_t j = 0; j < DV * M; j++) { | |||||
if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { | if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); | PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); | ||||
} | } | ||||
} | } | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); | PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); | ||||
for (int i = 0; i < N0 - 1; i++) { | |||||
for (size_t i = 0; i < N0 - 1; i++) { | |||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, | PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, | ||||
Ln0Inv, | Ln0Inv, | ||||
LPosOnes[i], | LPosOnes[i], | ||||
DV * M); | DV * M); | ||||
} | } | ||||
for (int i = 0; i < N0 - 1; i++) { | |||||
for (size_t i = 0; i < N0 - 1; i++) { | |||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); | PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); | ||||
} | } | ||||
} | } | ||||
@@ -110,24 +110,27 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK | |||||
POSITION_T auxSparse[DV * M]; | POSITION_T auxSparse[DV * M]; | ||||
POSITION_T Ln0trSparse[DV * M]; | POSITION_T Ln0trSparse[DV * M]; | ||||
DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0}; | DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0}; | ||||
DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; | |||||
DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; | DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; | ||||
unsigned char processedQOnes[N0]; | |||||
uint8_t processedQOnes[N0]; | |||||
int rejections = sk->rejections; | int rejections = sk->rejections; | ||||
int decrypt_ok = 0; | |||||
int err_weight; | |||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); | PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); | ||||
do { | do { | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander); | PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander); | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander); | PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander); | ||||
for (int i = 0; i < N0; i++) { | |||||
for (int j = 0; j < DV * M; j++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
for (size_t j = 0; j < DV * M; j++) { | |||||
LPosOnes[i][j] = INVALID_POS_VALUE; | LPosOnes[i][j] = INVALID_POS_VALUE; | ||||
} | } | ||||
} | } | ||||
memset(processedQOnes, 0x00, sizeof(processedQOnes)); | memset(processedQOnes, 0x00, sizeof(processedQOnes)); | ||||
for (int colQ = 0; colQ < N0; colQ++) { | |||||
for (int i = 0; i < N0; i++) { | |||||
for (size_t colQ = 0; colQ < N0; colQ++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, | PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, | ||||
DV, HPosOnes[i], | DV, HPosOnes[i], | ||||
qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); | qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); | ||||
@@ -143,15 +146,15 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK | |||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes); | PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes); | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes); | PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes); | ||||
for (int i = 0; i < DV * M; i++) { | |||||
for (size_t i = 0; i < DV * M; i++) { | |||||
Ln0trSparse[i] = INVALID_POS_VALUE; | Ln0trSparse[i] = INVALID_POS_VALUE; | ||||
auxSparse[i] = INVALID_POS_VALUE; | auxSparse[i] = INVALID_POS_VALUE; | ||||
} | } | ||||
for (int i = 0; i < N0; i++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, | PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, | ||||
DV, HPosOnes[i], | DV, HPosOnes[i], | ||||
qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1] ] ); | |||||
qBlockWeights[i][N0 - 1], &QPosOnes[i][M - qBlockWeights[i][N0 - 1]]); | |||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, | PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, | ||||
DV * M, Ln0trSparse, | DV * M, Ln0trSparse, | ||||
DV * M, auxSparse); | DV * M, auxSparse); | ||||
@@ -163,28 +166,27 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK | |||||
Ln0trSparse, | Ln0trSparse, | ||||
DV * M); | DV * M); | ||||
int decryptOk = 0; | |||||
decryptOk = PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(err_computed, | |||||
(const POSITION_T (*)[DV]) HtrPosOnes, | |||||
(const POSITION_T (*)[M]) QtrPosOnes, | |||||
privateSyndrome, sk->secondIterThreshold); | |||||
decrypt_ok = PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(err_computed, | |||||
(const POSITION_T (*)[DV]) HtrPosOnes, | |||||
(const POSITION_T (*)[M]) QtrPosOnes, | |||||
privateSyndrome, sk->secondIterThreshold); | |||||
int err_weight = 0; | |||||
for (int i = 0 ; i < N0; i++) { | |||||
err_weight = 0; | |||||
for (size_t i = 0 ; i < N0; i++) { | |||||
err_weight += PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i)); | err_weight += PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i)); | ||||
} | } | ||||
decryptOk = decryptOk && (err_weight == NUM_ERRORS_T); | |||||
decrypt_ok = decrypt_ok && (err_weight == NUM_ERRORS_T); | |||||
/* prepare mockup error vector in case a decoding failure occurs */ | /* prepare mockup error vector in case a decoding failure occurs */ | ||||
DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; | |||||
memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | ||||
memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH); | memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH); | ||||
memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00, | memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00, | ||||
(N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH); | (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH); | ||||
memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | ||||
// Overwrite on decryption failure | // Overwrite on decryption failure | ||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decryptOk); | |||||
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decrypt_ok); | |||||
return decryptOk; | |||||
return decrypt_ok; | |||||
} | } |
@@ -13,8 +13,8 @@ | |||||
maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier | maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier | ||||
*/ | */ | ||||
static void seedexpander_init(AES_XOF_struct *ctx, | static void seedexpander_init(AES_XOF_struct *ctx, | ||||
unsigned char *seed, | |||||
unsigned char *diversifier, | |||||
uint8_t *seed, | |||||
uint8_t *diversifier, | |||||
size_t maxlen) { | size_t maxlen) { | ||||
ctx->length_remaining = maxlen; | ctx->length_remaining = maxlen; | ||||
@@ -38,13 +38,13 @@ static void seedexpander_init(AES_XOF_struct *ctx, | |||||
} | } | ||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, | void PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, | ||||
const unsigned char *trng_entropy | |||||
const uint8_t *trng_entropy | |||||
/* TRNG_BYTE_LENGTH wide buffer */) { | /* TRNG_BYTE_LENGTH wide buffer */) { | ||||
/*the NIST seedexpander will however access 32B from this buffer */ | /*the NIST seedexpander will however access 32B from this buffer */ | ||||
unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; | unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; | ||||
unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 }; | |||||
unsigned char diversifier[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; | |||||
uint8_t prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = {0x00}; | |||||
uint8_t diversifier[8] = {0}; | |||||
memcpy(prng_buffer, | memcpy(prng_buffer, | ||||
trng_entropy, | trng_entropy, | ||||
@@ -61,7 +61,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, | |||||
x - returns the XOF data | x - returns the XOF data | ||||
xlen - number of bytes to return | xlen - number of bytes to return | ||||
*/ | */ | ||||
int PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) { | |||||
int PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(AES_XOF_struct *ctx, uint8_t *x, size_t xlen) { | |||||
size_t offset; | size_t offset; | ||||
aes256ctx ctx256; | aes256ctx ctx256; | ||||
@@ -5,6 +5,17 @@ | |||||
Source: https://sorting.cr.yp.to | Source: https://sorting.cr.yp.to | ||||
*/ | */ | ||||
#define int32_MINMAX(a,b) \ | |||||
do { \ | |||||
int32 ab = (b) ^ (a); \ | |||||
int32 c = (b) - (a); \ | |||||
c ^= ab & (c ^ (b)); \ | |||||
c >>= 31; \ | |||||
c &= ab; \ | |||||
(a) ^= c; \ | |||||
(b) ^= c; \ | |||||
} while(0) | |||||
static void int32_sort(int32 *x, size_t n) { | static void int32_sort(int32 *x, size_t n) { | ||||
size_t top, p, q, r, i, j; | size_t top, p, q, r, i, j; | ||||
@@ -6,17 +6,6 @@ | |||||
#define int32 int32_t | #define int32 int32_t | ||||
#define int32_MINMAX(a,b) \ | |||||
do { \ | |||||
int32 ab = (b) ^ (a); \ | |||||
int32 c = (b) - (a); \ | |||||
c ^= ab & (c ^ (b)); \ | |||||
c >>= 31; \ | |||||
c &= ab; \ | |||||
(a) ^= c; \ | |||||
(b) ^= c; \ | |||||
} while(0) | |||||
void PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(uint32_t *x, size_t n); | void PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(uint32_t *x, size_t n); | ||||
#endif | #endif |
@@ -1,23 +1,19 @@ | |||||
#include "H_Q_matrices_generation.h" | #include "H_Q_matrices_generation.h" | ||||
#include "gf2x_arith_mod_xPplusOne.h" | #include "gf2x_arith_mod_xPplusOne.h" | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], | |||||
AES_XOF_struct *keys_expander) { | |||||
for (int i = 0; i < N0; i++) { | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], AES_XOF_struct *keys_expander) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
/* Generate a random block of Htr */ | /* Generate a random block of Htr */ | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], | |||||
DV, | |||||
keys_expander); | |||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], DV, keys_expander); | |||||
} | } | ||||
} | } | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], | |||||
AES_XOF_struct *keys_expander) { | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], AES_XOF_struct *keys_expander) { | |||||
size_t placed_ones; | |||||
for (int i = 0; i < N0; i++) { | |||||
int placed_ones = 0; | |||||
for (int j = 0; j < N0; j++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
placed_ones = 0; | |||||
for (size_t j = 0; j < N0; j++) { | |||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones], | PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones], | ||||
qBlockWeights[i][j], | qBlockWeights[i][j], | ||||
keys_expander); | keys_expander); | ||||
@@ -26,29 +22,27 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], | |||||
} | } | ||||
} | } | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], /* output*/ | |||||
POSITION_T HPosOnes[N0][DV]) { | |||||
for (int i = 0; i < N0; i++) { | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], POSITION_T HPosOnes[N0][DV]) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
/* Obtain directly the sparse representation of the block of H */ | /* Obtain directly the sparse representation of the block of H */ | ||||
for (int k = 0; k < DV; k++) { | |||||
for (size_t k = 0; k < DV; k++) { | |||||
HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */ | HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */ | ||||
}// end for k | |||||
} | |||||
} | } | ||||
} | } | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], /* output*/ | |||||
POSITION_T QPosOnes[N0][M]) { | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], POSITION_T QPosOnes[N0][M]) { | |||||
POSITION_T transposed_ones_idx[N0] = {0x00}; | |||||
size_t currQoneIdx, endQblockIdx; | |||||
unsigned transposed_ones_idx[N0] = {0x00}; | |||||
for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { | |||||
int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] | |||||
int endQblockIdx = 0; | |||||
for (size_t source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { | |||||
currQoneIdx = 0; // position in the column of QtrPosOnes[][...] | |||||
endQblockIdx = 0; | |||||
for (int blockIdx = 0; blockIdx < N0; blockIdx++) { | for (int blockIdx = 0; blockIdx < N0; blockIdx++) { | ||||
endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; | endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; | ||||
for (; currQoneIdx < endQblockIdx; currQoneIdx++) { | for (; currQoneIdx < endQblockIdx; currQoneIdx++) { | ||||
QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P - | |||||
QPosOnes[source_row_idx][currQoneIdx]) % P; | |||||
QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = | |||||
(P - QPosOnes[source_row_idx][currQoneIdx]) % P; | |||||
transposed_ones_idx[blockIdx]++; | transposed_ones_idx[blockIdx]++; | ||||
} | } | ||||
} | } | ||||
@@ -7,22 +7,26 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(DIGIT err[], | |||||
const POSITION_T HtrPosOnes[N0][DV], | const POSITION_T HtrPosOnes[N0][DV], | ||||
const POSITION_T QtrPosOnes[N0][M], | const POSITION_T QtrPosOnes[N0][M], | ||||
DIGIT privateSyndrome[], | DIGIT privateSyndrome[], | ||||
uint8_t threshold) { | |||||
uint8_t secondIterThreshold) { | |||||
DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; | |||||
uint8_t unsatParityChecks[N0 * P]; | uint8_t unsatParityChecks[N0 * P]; | ||||
POSITION_T currQBlkPos[M], currQBitPos[M]; | POSITION_T currQBlkPos[M], currQBitPos[M]; | ||||
DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; | |||||
POSITION_T syndromePosToFlip, tmp; | |||||
unsigned int correlation, corrt_syndrome_based; | |||||
size_t currQoneIdx, endQblockIdx, currblockoffset; | |||||
int check; | int check; | ||||
int iteration = 0; | int iteration = 0; | ||||
unsigned int corrt_syndrome_based; | |||||
do { | do { | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); | PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); | ||||
memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); | memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); | ||||
for (int i = 0; i < N0; i++) { | |||||
for (int valueIdx = 0; valueIdx < P; valueIdx++) { | |||||
for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { | |||||
POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx); | |||||
for (size_t i = 0; i < N0; i++) { | |||||
for (size_t valueIdx = 0; valueIdx < P; valueIdx++) { | |||||
for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { | |||||
tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? | |||||
(HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : | |||||
(HtrPosOnes[i][HtrOneIdx] + valueIdx); | |||||
if (PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { | if (PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { | ||||
unsatParityChecks[i * P + valueIdx]++; | unsatParityChecks[i * P + valueIdx]++; | ||||
} | } | ||||
@@ -31,33 +35,32 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(DIGIT err[], | |||||
} | } | ||||
/* iteration based threshold determination*/ | /* iteration based threshold determination*/ | ||||
corrt_syndrome_based = iteration ? (unsigned int) threshold : B0; | |||||
corrt_syndrome_based = iteration * secondIterThreshold + (1 - iteration) * B0; | |||||
//Computation of correlation with a full Q matrix | |||||
for (int i = 0; i < N0; i++) { | |||||
for (int j = 0; j < P; j++) { | |||||
int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] | |||||
int endQblockIdx = 0; | |||||
unsigned int correlation = 0; | |||||
// Computation of correlation with a full Q matrix | |||||
for (size_t i = 0; i < N0; i++) { | |||||
for (size_t j = 0; j < P; j++) { | |||||
currQoneIdx = endQblockIdx = 0; | |||||
correlation = 0; | |||||
for (int blockIdx = 0; blockIdx < N0; blockIdx++) { | |||||
for (size_t blockIdx = 0; blockIdx < N0; blockIdx++) { | |||||
endQblockIdx += qBlockWeights[blockIdx][i]; | endQblockIdx += qBlockWeights[blockIdx][i]; | ||||
int currblockoffset = blockIdx * P; | |||||
currblockoffset = blockIdx * P; | |||||
for (; currQoneIdx < endQblockIdx; currQoneIdx++) { | for (; currQoneIdx < endQblockIdx; currQoneIdx++) { | ||||
POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j; | |||||
tmp = QtrPosOnes[i][currQoneIdx] + j; | |||||
tmp = tmp >= P ? tmp - P : tmp; | tmp = tmp >= P ? tmp - P : tmp; | ||||
currQBitPos[currQoneIdx] = tmp; | currQBitPos[currQoneIdx] = tmp; | ||||
currQBlkPos[currQoneIdx] = blockIdx; | currQBlkPos[currQoneIdx] = blockIdx; | ||||
correlation += unsatParityChecks[tmp + currblockoffset]; | correlation += unsatParityChecks[tmp + currblockoffset]; | ||||
} | } | ||||
} | } | ||||
/* Correlation based flipping */ | /* Correlation based flipping */ | ||||
if (correlation >= corrt_syndrome_based) { | if (correlation >= corrt_syndrome_based) { | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); | PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); | ||||
for (int v = 0; v < M; v++) { | |||||
POSITION_T syndromePosToFlip; | |||||
for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { | |||||
syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] ); | |||||
for (size_t v = 0; v < M; v++) { | |||||
for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { | |||||
syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v]); | |||||
syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; | syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); | PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); | ||||
} | } | ||||
@@ -14,47 +14,49 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_ | |||||
unsigned int maxMut[N0], maxMutMinusOne[N0]; | unsigned int maxMut[N0], maxMutMinusOne[N0]; | ||||
unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; | unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; | ||||
unsigned int gammaHist[N0][DV * M + 1] = {{0}}; | unsigned int gammaHist[N0][DV * M + 1] = {{0}}; | ||||
unsigned int toAdd; | |||||
size_t histIdx; | |||||
for (int i = 0; i < N0; i++) { | |||||
for (int j = 0; j < DV * M; j++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
for (size_t j = 0; j < DV * M; j++) { | |||||
if (LSparse[i][j] != 0) { | if (LSparse[i][j] != 0) { | ||||
LSparse_loc[i][j] = (P - LSparse[i][j]) ; | |||||
LSparse_loc[i][j] = (P - LSparse[i][j]); | |||||
} | } | ||||
} | } | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M); | PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M); | ||||
} | } | ||||
for (int i = 0; i < N0; i++ ) { | |||||
for (int j = 0; j < N0; j++ ) { | |||||
for (int k = 0; k < (DV * M); k++) { | |||||
for (int l = 0; l < (DV * M); l++) { | |||||
gamma[i][j][ (P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P ]++; | |||||
for (size_t i = 0; i < N0; i++ ) { | |||||
for (size_t j = 0; j < N0; j++) { | |||||
for (size_t k = 0; k < (DV * M); k++) { | |||||
for (size_t l = 0; l < (DV * M); l++) { | |||||
gamma[i][j][(P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P]++; | |||||
} | } | ||||
} | } | ||||
} | } | ||||
} | } | ||||
for (int i = 0; i < N0; i++ ) { | |||||
for (int j = 0; j < N0; j++ ) { | |||||
for (size_t i = 0; i < N0; i++ ) { | |||||
for (size_t j = 0; j < N0; j++ ) { | |||||
gamma[i][j][0] = 0; | gamma[i][j][0] = 0; | ||||
} | } | ||||
} | } | ||||
/* build histogram of values in gamma */ | /* build histogram of values in gamma */ | ||||
for (int i = 0; i < N0; i++ ) { | |||||
for (int j = 0; j < N0; j++ ) { | |||||
for (int k = 0; k < P; k++) { | |||||
for (size_t i = 0; i < N0; i++ ) { | |||||
for (size_t j = 0; j < N0; j++ ) { | |||||
for (size_t k = 0; k < P; k++) { | |||||
gammaHist[i][gamma[i][j][k]]++; | gammaHist[i][gamma[i][j][k]]++; | ||||
} | } | ||||
} | } | ||||
} | } | ||||
for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { | |||||
unsigned int toAdd = T_BAR - 1; | |||||
for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { | |||||
maxMutMinusOne[gammaBlockRowIdx] = 0; | maxMutMinusOne[gammaBlockRowIdx] = 0; | ||||
unsigned int histIdx = DV * M; | |||||
histIdx = DV * M; | |||||
toAdd = T_BAR - 1; | |||||
while ( (histIdx > 0) && (toAdd > 0)) { | while ( (histIdx > 0) && (toAdd > 0)) { | ||||
if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { | if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { | ||||
maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; | maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; | ||||
@@ -71,7 +73,7 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_ | |||||
/*seek max values across all gamma blocks */ | /*seek max values across all gamma blocks */ | ||||
allBlockMaxSumst = maxMut[0]; | allBlockMaxSumst = maxMut[0]; | ||||
allBlockMaxSumstMinusOne = maxMutMinusOne[0]; | allBlockMaxSumstMinusOne = maxMutMinusOne[0]; | ||||
for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { | |||||
for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { | |||||
allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? | allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? | ||||
maxMut[gammaBlockRowIdx] : | maxMut[gammaBlockRowIdx] : | ||||
allBlockMaxSumst; | allBlockMaxSumst; | ||||
@@ -52,7 +52,7 @@ static void gf2x_mul1(DIGIT *R, const DIGIT A, const DIGIT B) { | |||||
R[0] = 0; | R[0] = 0; | ||||
R[1] = (A & 1) * B; | R[1] = (A & 1) * B; | ||||
for (unsigned i = 1; i < DIGIT_SIZE_b; i++) { | |||||
for (uint8_t i = 1; i < DIGIT_SIZE_b; i++) { | |||||
tmp = ((A >> i) & 1) * B; | tmp = ((A >> i) & 1) * B; | ||||
R[1] ^= tmp << i; | R[1] ^= tmp << i; | ||||
R[0] ^= tmp >> (DIGIT_SIZE_b - i); | R[0] ^= tmp >> (DIGIT_SIZE_b - i); | ||||
@@ -5,39 +5,39 @@ | |||||
#include <string.h> // memcpy(...), memset(...) | #include <string.h> // memcpy(...), memset(...) | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { | void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { | ||||
for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { | |||||
for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
dest[i] = in[i]; | dest[i] = in[i]; | ||||
} | } | ||||
} | } | ||||
/* returns the coefficient of the x^exponent term as the LSB of a digit */ | /* returns the coefficient of the x^exponent term as the LSB of a digit */ | ||||
DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) { | |||||
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent) { | |||||
size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
size_t digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; | return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; | ||||
} | } | ||||
/* sets the coefficient of the x^exponent term as the LSB of a digit */ | /* sets the coefficient of the x^exponent term as the LSB of a digit */ | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) { | |||||
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value) { | |||||
size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
size_t digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
/* clear given coefficient */ | /* clear given coefficient */ | ||||
DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
DIGIT mask = ~(((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
poly[digitIdx] = poly[digitIdx] & mask; | poly[digitIdx] = poly[digitIdx] & mask; | ||||
poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
poly[digitIdx] = poly[digitIdx] | ((value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
} | } | ||||
/* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ | /* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) { | |||||
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent) { | |||||
size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
size_t digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
/* clear given coefficient */ | /* clear given coefficient */ | ||||
DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
DIGIT mask = (((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
poly[digitIdx] = poly[digitIdx] ^ mask; | poly[digitIdx] = poly[digitIdx] ^ mask; | ||||
} | } | ||||
@@ -51,7 +51,7 @@ static int popcount_uint64t(uint64_t x) { | |||||
} | } | ||||
/* population count for a single polynomial */ | /* population count for a single polynomial */ | ||||
int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(DIGIT *poly) { | |||||
int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(const DIGIT *poly) { | |||||
int ret = 0; | int ret = 0; | ||||
for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { | for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { | ||||
ret += popcount_uint64t(poly[i]); | ret += popcount_uint64t(poly[i]); | ||||
@@ -74,10 +74,9 @@ static void gf2x_mod(DIGIT out[], const DIGIT in[]) { | |||||
out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1; | out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1; | ||||
} | } | ||||
static void right_bit_shift(unsigned int length, DIGIT in[]) { | |||||
unsigned int j; | |||||
for (j = length - 1; j > 0 ; j--) { | |||||
static void right_bit_shift(size_t length, DIGIT in[]) { | |||||
size_t j; | |||||
for (j = length - 1; j > 0; j--) { | |||||
in[j] >>= 1; | in[j] >>= 1; | ||||
in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); | in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); | ||||
} | } | ||||
@@ -86,8 +85,8 @@ static void right_bit_shift(unsigned int length, DIGIT in[]) { | |||||
/* shifts by whole digits */ | /* shifts by whole digits */ | ||||
static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) { | |||||
unsigned int j; | |||||
static void left_DIGIT_shift_n(size_t length, DIGIT in[], size_t amount) { | |||||
size_t j; | |||||
for (j = 0; (j + amount) < length; j++) { | for (j = 0; (j + amount) < length; j++) { | ||||
in[j] = in[j + amount]; | in[j] = in[j + amount]; | ||||
} | } | ||||
@@ -97,7 +96,7 @@ static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amo | |||||
} | } | ||||
/* may shift by an arbitrary amount*/ | /* may shift by an arbitrary amount*/ | ||||
static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) { | |||||
static void left_bit_shift_wide_n(size_t length, DIGIT in[], size_t amount) { | |||||
left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); | left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); | PQCLEAN_LEDAKEMLT32_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); | ||||
} | } | ||||
@@ -123,18 +122,22 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) { | |||||
DIGIT mask = (DIGIT)0x1; | DIGIT mask = (DIGIT)0x1; | ||||
DIGIT rev1, rev2, a00; | DIGIT rev1, rev2, a00; | ||||
int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; | |||||
int slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; | |||||
a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; | a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; | ||||
right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); | right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); | ||||
for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { | |||||
for (size_t i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { | |||||
rev1 = reverse_digit(A[i]); | rev1 = reverse_digit(A[i]); | ||||
rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); | rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); | ||||
A[i] = rev2; | A[i] = rev2; | ||||
A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; | A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; | ||||
} | } | ||||
if (NUM_DIGITS_GF2X_ELEMENT % 2 == 1) { | |||||
A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]); | |||||
} | |||||
if (slack_bits_amount) { | if (slack_bits_amount) { | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); | PQCLEAN_LEDAKEMLT32_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); | ||||
} | } | ||||
@@ -151,10 +154,9 @@ static void rotate_bit_right(DIGIT in[]) { /* x^{-1} * in(x) mod x^P+1 */ | |||||
} | } | ||||
/* cond swap: swaps digits A and B if swap_mask == -1 */ | /* cond swap: swaps digits A and B if swap_mask == -1 */ | ||||
static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { | |||||
int i; | |||||
static void gf2x_cswap(DIGIT *a, DIGIT *b, int32_t swap_mask) { | |||||
DIGIT t; | DIGIT t; | ||||
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
t = swap_mask & (a[i] ^ b[i]); | t = swap_mask & (a[i] ^ b[i]); | ||||
a[i] ^= t; | a[i] ^= t; | ||||
b[i] ^= t; | b[i] ^= t; | ||||
@@ -162,18 +164,18 @@ static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { | |||||
} | } | ||||
/* returns -1 mask if x != 0, otherwise 0 */ | /* returns -1 mask if x != 0, otherwise 0 */ | ||||
static inline int nonzero(DIGIT x) { | |||||
static inline int32_t nonzero(DIGIT x) { | |||||
DIGIT t = x; | DIGIT t = x; | ||||
t = (~t) + 1; | t = (~t) + 1; | ||||
t >>= DIGIT_SIZE_b - 1; | t >>= DIGIT_SIZE_b - 1; | ||||
return -((int)t); | |||||
return -((int32_t)t); | |||||
} | } | ||||
/* returns -1 mask if x < 0 else 0 */ | /* returns -1 mask if x < 0 else 0 */ | ||||
static inline int negative(int x) { | |||||
static inline int32_t negative(int x) { | |||||
uint32_t u = x; | uint32_t u = x; | ||||
u >>= 31; | u >>= 31; | ||||
return -((int)u); | |||||
return -((int32_t)u); | |||||
} | } | ||||
/* return f(0) as digit */ | /* return f(0) as digit */ | ||||
@@ -191,7 +193,7 @@ static void gf2x_mult_scalar_acc(DIGIT *f, const DIGIT *g, const DIGIT s) { | |||||
/* constant-time inverse, source: gcd.cr.yp.to */ | /* constant-time inverse, source: gcd.cr.yp.to */ | ||||
int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { | int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { | ||||
int i, loop, swap, delta = 1; | |||||
int32_t swap, delta = 1; | |||||
DIGIT g0_mask; | DIGIT g0_mask; | ||||
DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1 | DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1 | ||||
@@ -202,17 +204,17 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) | |||||
f[NUM_DIGITS_GF2X_MODULUS - 1] = 1; | f[NUM_DIGITS_GF2X_MODULUS - 1] = 1; | ||||
f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); | f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); | ||||
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
g[i] = in[i]; | g[i] = in[i]; | ||||
} | } | ||||
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
v[i] = 0; | v[i] = 0; | ||||
} | } | ||||
r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1; | r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1; | ||||
for (loop = 0; loop < 2 * P - 1; ++loop) { | |||||
for (int loop = 0; loop < 2 * P - 1; ++loop) { | |||||
swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0 | swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0 | ||||
delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap | delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap | ||||
@@ -247,7 +249,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], con | |||||
/*PRE: the representation of the sparse coefficients is sorted in increasing | /*PRE: the representation of the sparse coefficients is sorted in increasing | ||||
order of the coefficients themselves */ | order of the coefficients themselves */ | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], | void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], | ||||
POSITION_T sparse[], unsigned int nPos) { | |||||
POSITION_T sparse[], size_t nPos) { | |||||
DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; | DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; | ||||
DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; | DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; | ||||
@@ -258,7 +260,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons | |||||
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); | left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); | ||||
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); | left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); | ||||
for (unsigned int i = 1; i < nPos; i++) { | |||||
for (size_t i = 1; i < nPos; i++) { | |||||
if (sparse[i] != INVALID_POS_VALUE) { | if (sparse[i] != INVALID_POS_VALUE) { | ||||
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); | left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); | PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); | ||||
@@ -270,10 +272,9 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons | |||||
} | } | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) { | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]) { | |||||
POSITION_T t; | POSITION_T t; | ||||
int i = 0, j; | |||||
size_t i = 0, j; | |||||
if (A[i] == 0) { | if (A[i] == 0) { | ||||
i = 1; | i = 1; | ||||
@@ -297,6 +298,9 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R | |||||
size_t sizeB, const POSITION_T B[]) { | size_t sizeB, const POSITION_T B[]) { | ||||
POSITION_T prod; | POSITION_T prod; | ||||
POSITION_T lastReadPos; | |||||
size_t duplicateCount; | |||||
size_t write_idx, read_idx; | |||||
/* compute all the coefficients, filling invalid positions with P*/ | /* compute all the coefficients, filling invalid positions with P*/ | ||||
size_t lastFilledPos = 0; | size_t lastFilledPos = 0; | ||||
@@ -317,12 +321,11 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R | |||||
Res[lastFilledPos] = INVALID_POS_VALUE; | Res[lastFilledPos] = INVALID_POS_VALUE; | ||||
lastFilledPos++; | lastFilledPos++; | ||||
} | } | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(Res, sizeR); | PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(Res, sizeR); | ||||
/* eliminate duplicates */ | /* eliminate duplicates */ | ||||
POSITION_T lastReadPos = Res[0]; | |||||
size_t duplicateCount; | |||||
size_t write_idx = 0; | |||||
size_t read_idx = 0; | |||||
write_idx = read_idx = 0; | |||||
while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { | while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { | ||||
lastReadPos = Res[read_idx]; | lastReadPos = Res[read_idx]; | ||||
read_idx++; | read_idx++; | ||||
@@ -344,13 +347,12 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R | |||||
/* the implementation is safe even in case A or B alias with the result | /* the implementation is safe even in case A or B alias with the result | ||||
* PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ | * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse( | |||||
int sizeR, POSITION_T Res[], | |||||
int sizeA, const POSITION_T A[], | |||||
int sizeB, const POSITION_T B[]) { | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], | |||||
size_t sizeA, const POSITION_T A[], | |||||
size_t sizeB, const POSITION_T B[]) { | |||||
POSITION_T tmpRes[DV * M]; | POSITION_T tmpRes[DV * M]; | ||||
int idxA = 0, idxB = 0, idxR = 0; | |||||
size_t idxA = 0, idxB = 0, idxR = 0; | |||||
while ( idxA < sizeA && | while ( idxA < sizeA && | ||||
idxB < sizeB && | idxB < sizeB && | ||||
A[idxA] != INVALID_POS_VALUE && | A[idxA] != INVALID_POS_VALUE && | ||||
@@ -419,18 +421,18 @@ static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct | |||||
/* Obtains fresh randomness and seed-expands it until all the required positions | /* Obtains fresh randomness and seed-expands it until all the required positions | ||||
* for the '1's in the circulant block are obtained */ | * for the '1's in the circulant block are obtained */ | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, | void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, | ||||
int countOnes, | |||||
size_t countOnes, | |||||
AES_XOF_struct *seed_expander_ctx) { | AES_XOF_struct *seed_expander_ctx) { | ||||
int duplicated, placedOnes = 0; | |||||
uint32_t p; | |||||
size_t duplicated, placedOnes = 0; | |||||
POSITION_T p; | |||||
while (placedOnes < countOnes) { | while (placedOnes < countOnes) { | ||||
p = rand_range(NUM_BITS_GF2X_ELEMENT, | p = rand_range(NUM_BITS_GF2X_ELEMENT, | ||||
P_BITS, | P_BITS, | ||||
seed_expander_ctx); | seed_expander_ctx); | ||||
duplicated = 0; | duplicated = 0; | ||||
for (int j = 0; j < placedOnes; j++) { | |||||
for (size_t j = 0; j < placedOnes; j++) { | |||||
if (pos_ones[j] == p) { | if (pos_ones[j] == p) { | ||||
duplicated = 1; | duplicated = 1; | ||||
} | } | ||||
@@ -16,22 +16,22 @@ | |||||
#define P_BITS (17) | #define P_BITS (17) | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); | void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); | ||||
DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent); | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value); | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent); | |||||
int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(DIGIT *poly); | |||||
DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent); | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value); | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent); | |||||
int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(const DIGIT *poly); | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); | void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); | void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); | void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx); | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, size_t countOnes, AES_XOF_struct *seed_expander_ctx); | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); | void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx); | void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx); | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]); | void PQCLEAN_LEDAKEMLT32_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]); | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]); | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]); | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]); | |||||
int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); | int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); | void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos); | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], size_t nPos); | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); | void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); | void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); | ||||
@@ -107,18 +107,19 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, | |||||
uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH]; | uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH]; | ||||
uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0}; | uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0}; | ||||
uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0}; | uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0}; | ||||
int decode_ok, decrypt_ok, equal; | |||||
unpack_ct(syndrome, ct); | unpack_ct(syndrome, ct); | ||||
int decode_ok = PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(decoded_error_vector, | |||||
(const privateKeyNiederreiter_t *)sk, syndrome); | |||||
decode_ok = PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(decoded_error_vector, | |||||
(const privateKeyNiederreiter_t *)sk, syndrome); | |||||
pack_error(decoded_error_bytes, decoded_error_vector); | pack_error(decoded_error_bytes, decoded_error_vector); | ||||
HASH_FUNCTION(hashedErrorVector, decoded_error_bytes, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | HASH_FUNCTION(hashedErrorVector, decoded_error_bytes, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | ||||
memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH); | memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH); | ||||
for (int i = 0; i < TRNG_BYTE_LENGTH; ++i) { | |||||
for (size_t i = 0; i < TRNG_BYTE_LENGTH; ++i) { | |||||
decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^ | decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^ | ||||
hashedAndTruncatedErrorVector[i]; | hashedAndTruncatedErrorVector[i]; | ||||
} | } | ||||
@@ -135,11 +136,11 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, | |||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos); | PQCLEAN_LEDAKEMLT32_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos); | ||||
int equal = PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_verify(decoded_error_vector, | |||||
reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); | |||||
equal = PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_verify(decoded_error_vector, | |||||
reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); | |||||
// equal == 0, if the reconstructed error vector match !!! | // equal == 0, if the reconstructed error vector match !!! | ||||
int decryptOk = (decode_ok == 1 && equal == 0); | |||||
decrypt_ok = (decode_ok == 1 && equal == 0); | |||||
memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH); | memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH); | ||||
memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH); | memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH); | ||||
@@ -148,7 +149,7 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, | |||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_cmov(ss_input + sizeof(decoded_seed), | PQCLEAN_LEDAKEMLT32_LEAKTIME_cmov(ss_input + sizeof(decoded_seed), | ||||
((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret, | ((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret, | ||||
TRNG_BYTE_LENGTH, | TRNG_BYTE_LENGTH, | ||||
!decryptOk); | |||||
!decrypt_ok); | |||||
HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH); | HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH); | ||||
@@ -49,7 +49,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p | |||||
} | } | ||||
} | } | ||||
is_L_full = 1; | is_L_full = 1; | ||||
for (int i = 0; i < N0; i++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); | is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); | ||||
} | } | ||||
sk->rejections = sk->rejections + 1; | sk->rejections = sk->rejections + 1; | ||||
@@ -63,21 +63,21 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p | |||||
sk->decryption_failure_secret, | sk->decryption_failure_secret, | ||||
(unsigned long)TRNG_BYTE_LENGTH); | (unsigned long)TRNG_BYTE_LENGTH); | ||||
for (int j = 0; j < DV * M; j++) { | |||||
for (size_t j = 0; j < DV * M; j++) { | |||||
if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { | if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); | PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); | ||||
} | } | ||||
} | } | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); | PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); | ||||
for (int i = 0; i < N0 - 1; i++) { | |||||
for (size_t i = 0; i < N0 - 1; i++) { | |||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, | PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, | ||||
Ln0Inv, | Ln0Inv, | ||||
LPosOnes[i], | LPosOnes[i], | ||||
DV * M); | DV * M); | ||||
} | } | ||||
for (int i = 0; i < N0 - 1; i++) { | |||||
for (size_t i = 0; i < N0 - 1; i++) { | |||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); | PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); | ||||
} | } | ||||
} | } | ||||
@@ -110,24 +110,27 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK | |||||
POSITION_T auxSparse[DV * M]; | POSITION_T auxSparse[DV * M]; | ||||
POSITION_T Ln0trSparse[DV * M]; | POSITION_T Ln0trSparse[DV * M]; | ||||
DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0}; | DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0}; | ||||
DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; | |||||
DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; | DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; | ||||
unsigned char processedQOnes[N0]; | |||||
uint8_t processedQOnes[N0]; | |||||
int rejections = sk->rejections; | int rejections = sk->rejections; | ||||
int decrypt_ok = 0; | |||||
int err_weight; | |||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); | PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); | ||||
do { | do { | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander); | PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander); | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander); | PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander); | ||||
for (int i = 0; i < N0; i++) { | |||||
for (int j = 0; j < DV * M; j++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
for (size_t j = 0; j < DV * M; j++) { | |||||
LPosOnes[i][j] = INVALID_POS_VALUE; | LPosOnes[i][j] = INVALID_POS_VALUE; | ||||
} | } | ||||
} | } | ||||
memset(processedQOnes, 0x00, sizeof(processedQOnes)); | memset(processedQOnes, 0x00, sizeof(processedQOnes)); | ||||
for (int colQ = 0; colQ < N0; colQ++) { | |||||
for (int i = 0; i < N0; i++) { | |||||
for (size_t colQ = 0; colQ < N0; colQ++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, | PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, | ||||
DV, HPosOnes[i], | DV, HPosOnes[i], | ||||
qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); | qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); | ||||
@@ -143,15 +146,15 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK | |||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes); | PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes); | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes); | PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes); | ||||
for (int i = 0; i < DV * M; i++) { | |||||
for (size_t i = 0; i < DV * M; i++) { | |||||
Ln0trSparse[i] = INVALID_POS_VALUE; | Ln0trSparse[i] = INVALID_POS_VALUE; | ||||
auxSparse[i] = INVALID_POS_VALUE; | auxSparse[i] = INVALID_POS_VALUE; | ||||
} | } | ||||
for (int i = 0; i < N0; i++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, | PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, | ||||
DV, HPosOnes[i], | DV, HPosOnes[i], | ||||
qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1] ] ); | |||||
qBlockWeights[i][N0 - 1], &QPosOnes[i][M - qBlockWeights[i][N0 - 1]]); | |||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, | PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, | ||||
DV * M, Ln0trSparse, | DV * M, Ln0trSparse, | ||||
DV * M, auxSparse); | DV * M, auxSparse); | ||||
@@ -163,28 +166,27 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK | |||||
Ln0trSparse, | Ln0trSparse, | ||||
DV * M); | DV * M); | ||||
int decryptOk = 0; | |||||
decryptOk = PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(err_computed, | |||||
(const POSITION_T (*)[DV]) HtrPosOnes, | |||||
(const POSITION_T (*)[M]) QtrPosOnes, | |||||
privateSyndrome, sk->secondIterThreshold); | |||||
decrypt_ok = PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(err_computed, | |||||
(const POSITION_T (*)[DV]) HtrPosOnes, | |||||
(const POSITION_T (*)[M]) QtrPosOnes, | |||||
privateSyndrome, sk->secondIterThreshold); | |||||
int err_weight = 0; | |||||
for (int i = 0 ; i < N0; i++) { | |||||
err_weight = 0; | |||||
for (size_t i = 0 ; i < N0; i++) { | |||||
err_weight += PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i)); | err_weight += PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i)); | ||||
} | } | ||||
decryptOk = decryptOk && (err_weight == NUM_ERRORS_T); | |||||
decrypt_ok = decrypt_ok && (err_weight == NUM_ERRORS_T); | |||||
/* prepare mockup error vector in case a decoding failure occurs */ | /* prepare mockup error vector in case a decoding failure occurs */ | ||||
DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; | |||||
memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | ||||
memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH); | memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH); | ||||
memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00, | memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00, | ||||
(N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH); | (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH); | ||||
memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | ||||
// Overwrite on decryption failure | // Overwrite on decryption failure | ||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decryptOk); | |||||
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decrypt_ok); | |||||
return decryptOk; | |||||
return decrypt_ok; | |||||
} | } |
@@ -13,8 +13,8 @@ | |||||
maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier | maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier | ||||
*/ | */ | ||||
static void seedexpander_init(AES_XOF_struct *ctx, | static void seedexpander_init(AES_XOF_struct *ctx, | ||||
unsigned char *seed, | |||||
unsigned char *diversifier, | |||||
uint8_t *seed, | |||||
uint8_t *diversifier, | |||||
size_t maxlen) { | size_t maxlen) { | ||||
ctx->length_remaining = maxlen; | ctx->length_remaining = maxlen; | ||||
@@ -38,13 +38,13 @@ static void seedexpander_init(AES_XOF_struct *ctx, | |||||
} | } | ||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, | void PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, | ||||
const unsigned char *trng_entropy | |||||
const uint8_t *trng_entropy | |||||
/* TRNG_BYTE_LENGTH wide buffer */) { | /* TRNG_BYTE_LENGTH wide buffer */) { | ||||
/*the NIST seedexpander will however access 32B from this buffer */ | /*the NIST seedexpander will however access 32B from this buffer */ | ||||
unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; | unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; | ||||
unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 }; | |||||
unsigned char diversifier[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; | |||||
uint8_t prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = {0x00}; | |||||
uint8_t diversifier[8] = {0}; | |||||
memcpy(prng_buffer, | memcpy(prng_buffer, | ||||
trng_entropy, | trng_entropy, | ||||
@@ -61,7 +61,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, | |||||
x - returns the XOF data | x - returns the XOF data | ||||
xlen - number of bytes to return | xlen - number of bytes to return | ||||
*/ | */ | ||||
int PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) { | |||||
int PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(AES_XOF_struct *ctx, uint8_t *x, size_t xlen) { | |||||
size_t offset; | size_t offset; | ||||
aes256ctx ctx256; | aes256ctx ctx256; | ||||
@@ -5,6 +5,17 @@ | |||||
Source: https://sorting.cr.yp.to | Source: https://sorting.cr.yp.to | ||||
*/ | */ | ||||
#define int32_MINMAX(a,b) \ | |||||
do { \ | |||||
int32 ab = (b) ^ (a); \ | |||||
int32 c = (b) - (a); \ | |||||
c ^= ab & (c ^ (b)); \ | |||||
c >>= 31; \ | |||||
c &= ab; \ | |||||
(a) ^= c; \ | |||||
(b) ^= c; \ | |||||
} while(0) | |||||
static void int32_sort(int32 *x, size_t n) { | static void int32_sort(int32 *x, size_t n) { | ||||
size_t top, p, q, r, i, j; | size_t top, p, q, r, i, j; | ||||
@@ -6,17 +6,6 @@ | |||||
#define int32 int32_t | #define int32 int32_t | ||||
#define int32_MINMAX(a,b) \ | |||||
do { \ | |||||
int32 ab = (b) ^ (a); \ | |||||
int32 c = (b) - (a); \ | |||||
c ^= ab & (c ^ (b)); \ | |||||
c >>= 31; \ | |||||
c &= ab; \ | |||||
(a) ^= c; \ | |||||
(b) ^= c; \ | |||||
} while(0) | |||||
void PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(uint32_t *x, size_t n); | void PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(uint32_t *x, size_t n); | ||||
#endif | #endif |
@@ -1,23 +1,19 @@ | |||||
#include "H_Q_matrices_generation.h" | #include "H_Q_matrices_generation.h" | ||||
#include "gf2x_arith_mod_xPplusOne.h" | #include "gf2x_arith_mod_xPplusOne.h" | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], | |||||
AES_XOF_struct *keys_expander) { | |||||
for (int i = 0; i < N0; i++) { | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], AES_XOF_struct *keys_expander) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
/* Generate a random block of Htr */ | /* Generate a random block of Htr */ | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], | |||||
DV, | |||||
keys_expander); | |||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], DV, keys_expander); | |||||
} | } | ||||
} | } | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], | |||||
AES_XOF_struct *keys_expander) { | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], AES_XOF_struct *keys_expander) { | |||||
size_t placed_ones; | |||||
for (int i = 0; i < N0; i++) { | |||||
int placed_ones = 0; | |||||
for (int j = 0; j < N0; j++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
placed_ones = 0; | |||||
for (size_t j = 0; j < N0; j++) { | |||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones], | PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones], | ||||
qBlockWeights[i][j], | qBlockWeights[i][j], | ||||
keys_expander); | keys_expander); | ||||
@@ -26,29 +22,27 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], | |||||
} | } | ||||
} | } | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], /* output*/ | |||||
POSITION_T HPosOnes[N0][DV]) { | |||||
for (int i = 0; i < N0; i++) { | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], POSITION_T HPosOnes[N0][DV]) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
/* Obtain directly the sparse representation of the block of H */ | /* Obtain directly the sparse representation of the block of H */ | ||||
for (int k = 0; k < DV; k++) { | |||||
for (size_t k = 0; k < DV; k++) { | |||||
HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */ | HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */ | ||||
}// end for k | |||||
} | |||||
} | } | ||||
} | } | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], /* output*/ | |||||
POSITION_T QPosOnes[N0][M]) { | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], POSITION_T QPosOnes[N0][M]) { | |||||
POSITION_T transposed_ones_idx[N0] = {0x00}; | |||||
size_t currQoneIdx, endQblockIdx; | |||||
unsigned transposed_ones_idx[N0] = {0x00}; | |||||
for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { | |||||
int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] | |||||
int endQblockIdx = 0; | |||||
for (size_t source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { | |||||
currQoneIdx = 0; // position in the column of QtrPosOnes[][...] | |||||
endQblockIdx = 0; | |||||
for (int blockIdx = 0; blockIdx < N0; blockIdx++) { | for (int blockIdx = 0; blockIdx < N0; blockIdx++) { | ||||
endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; | endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; | ||||
for (; currQoneIdx < endQblockIdx; currQoneIdx++) { | for (; currQoneIdx < endQblockIdx; currQoneIdx++) { | ||||
QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P - | |||||
QPosOnes[source_row_idx][currQoneIdx]) % P; | |||||
QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = | |||||
(P - QPosOnes[source_row_idx][currQoneIdx]) % P; | |||||
transposed_ones_idx[blockIdx]++; | transposed_ones_idx[blockIdx]++; | ||||
} | } | ||||
} | } | ||||
@@ -7,22 +7,26 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(DIGIT err[], | |||||
const POSITION_T HtrPosOnes[N0][DV], | const POSITION_T HtrPosOnes[N0][DV], | ||||
const POSITION_T QtrPosOnes[N0][M], | const POSITION_T QtrPosOnes[N0][M], | ||||
DIGIT privateSyndrome[], | DIGIT privateSyndrome[], | ||||
uint8_t threshold) { | |||||
uint8_t secondIterThreshold) { | |||||
DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; | |||||
uint8_t unsatParityChecks[N0 * P]; | uint8_t unsatParityChecks[N0 * P]; | ||||
POSITION_T currQBlkPos[M], currQBitPos[M]; | POSITION_T currQBlkPos[M], currQBitPos[M]; | ||||
DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; | |||||
POSITION_T syndromePosToFlip, tmp; | |||||
unsigned int correlation, corrt_syndrome_based; | |||||
size_t currQoneIdx, endQblockIdx, currblockoffset; | |||||
int check; | int check; | ||||
int iteration = 0; | int iteration = 0; | ||||
unsigned int corrt_syndrome_based; | |||||
do { | do { | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); | PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); | ||||
memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); | memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); | ||||
for (int i = 0; i < N0; i++) { | |||||
for (int valueIdx = 0; valueIdx < P; valueIdx++) { | |||||
for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { | |||||
POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx); | |||||
for (size_t i = 0; i < N0; i++) { | |||||
for (size_t valueIdx = 0; valueIdx < P; valueIdx++) { | |||||
for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { | |||||
tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? | |||||
(HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : | |||||
(HtrPosOnes[i][HtrOneIdx] + valueIdx); | |||||
if (PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { | if (PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { | ||||
unsatParityChecks[i * P + valueIdx]++; | unsatParityChecks[i * P + valueIdx]++; | ||||
} | } | ||||
@@ -31,33 +35,32 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(DIGIT err[], | |||||
} | } | ||||
/* iteration based threshold determination*/ | /* iteration based threshold determination*/ | ||||
corrt_syndrome_based = iteration ? (unsigned int) threshold : B0; | |||||
corrt_syndrome_based = iteration * secondIterThreshold + (1 - iteration) * B0; | |||||
//Computation of correlation with a full Q matrix | |||||
for (int i = 0; i < N0; i++) { | |||||
for (int j = 0; j < P; j++) { | |||||
int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] | |||||
int endQblockIdx = 0; | |||||
unsigned int correlation = 0; | |||||
// Computation of correlation with a full Q matrix | |||||
for (size_t i = 0; i < N0; i++) { | |||||
for (size_t j = 0; j < P; j++) { | |||||
currQoneIdx = endQblockIdx = 0; | |||||
correlation = 0; | |||||
for (int blockIdx = 0; blockIdx < N0; blockIdx++) { | |||||
for (size_t blockIdx = 0; blockIdx < N0; blockIdx++) { | |||||
endQblockIdx += qBlockWeights[blockIdx][i]; | endQblockIdx += qBlockWeights[blockIdx][i]; | ||||
int currblockoffset = blockIdx * P; | |||||
currblockoffset = blockIdx * P; | |||||
for (; currQoneIdx < endQblockIdx; currQoneIdx++) { | for (; currQoneIdx < endQblockIdx; currQoneIdx++) { | ||||
POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j; | |||||
tmp = QtrPosOnes[i][currQoneIdx] + j; | |||||
tmp = tmp >= P ? tmp - P : tmp; | tmp = tmp >= P ? tmp - P : tmp; | ||||
currQBitPos[currQoneIdx] = tmp; | currQBitPos[currQoneIdx] = tmp; | ||||
currQBlkPos[currQoneIdx] = blockIdx; | currQBlkPos[currQoneIdx] = blockIdx; | ||||
correlation += unsatParityChecks[tmp + currblockoffset]; | correlation += unsatParityChecks[tmp + currblockoffset]; | ||||
} | } | ||||
} | } | ||||
/* Correlation based flipping */ | /* Correlation based flipping */ | ||||
if (correlation >= corrt_syndrome_based) { | if (correlation >= corrt_syndrome_based) { | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); | PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); | ||||
for (int v = 0; v < M; v++) { | |||||
POSITION_T syndromePosToFlip; | |||||
for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { | |||||
syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] ); | |||||
for (size_t v = 0; v < M; v++) { | |||||
for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { | |||||
syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v]); | |||||
syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; | syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); | PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); | ||||
} | } | ||||
@@ -14,47 +14,49 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_ | |||||
unsigned int maxMut[N0], maxMutMinusOne[N0]; | unsigned int maxMut[N0], maxMutMinusOne[N0]; | ||||
unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; | unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; | ||||
unsigned int gammaHist[N0][DV * M + 1] = {{0}}; | unsigned int gammaHist[N0][DV * M + 1] = {{0}}; | ||||
unsigned int toAdd; | |||||
size_t histIdx; | |||||
for (int i = 0; i < N0; i++) { | |||||
for (int j = 0; j < DV * M; j++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
for (size_t j = 0; j < DV * M; j++) { | |||||
if (LSparse[i][j] != 0) { | if (LSparse[i][j] != 0) { | ||||
LSparse_loc[i][j] = (P - LSparse[i][j]) ; | |||||
LSparse_loc[i][j] = (P - LSparse[i][j]); | |||||
} | } | ||||
} | } | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M); | PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M); | ||||
} | } | ||||
for (int i = 0; i < N0; i++ ) { | |||||
for (int j = 0; j < N0; j++ ) { | |||||
for (int k = 0; k < (DV * M); k++) { | |||||
for (int l = 0; l < (DV * M); l++) { | |||||
gamma[i][j][ (P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P ]++; | |||||
for (size_t i = 0; i < N0; i++ ) { | |||||
for (size_t j = 0; j < N0; j++) { | |||||
for (size_t k = 0; k < (DV * M); k++) { | |||||
for (size_t l = 0; l < (DV * M); l++) { | |||||
gamma[i][j][(P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P]++; | |||||
} | } | ||||
} | } | ||||
} | } | ||||
} | } | ||||
for (int i = 0; i < N0; i++ ) { | |||||
for (int j = 0; j < N0; j++ ) { | |||||
for (size_t i = 0; i < N0; i++ ) { | |||||
for (size_t j = 0; j < N0; j++ ) { | |||||
gamma[i][j][0] = 0; | gamma[i][j][0] = 0; | ||||
} | } | ||||
} | } | ||||
/* build histogram of values in gamma */ | /* build histogram of values in gamma */ | ||||
for (int i = 0; i < N0; i++ ) { | |||||
for (int j = 0; j < N0; j++ ) { | |||||
for (int k = 0; k < P; k++) { | |||||
for (size_t i = 0; i < N0; i++ ) { | |||||
for (size_t j = 0; j < N0; j++ ) { | |||||
for (size_t k = 0; k < P; k++) { | |||||
gammaHist[i][gamma[i][j][k]]++; | gammaHist[i][gamma[i][j][k]]++; | ||||
} | } | ||||
} | } | ||||
} | } | ||||
for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { | |||||
unsigned int toAdd = T_BAR - 1; | |||||
for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { | |||||
maxMutMinusOne[gammaBlockRowIdx] = 0; | maxMutMinusOne[gammaBlockRowIdx] = 0; | ||||
unsigned int histIdx = DV * M; | |||||
histIdx = DV * M; | |||||
toAdd = T_BAR - 1; | |||||
while ( (histIdx > 0) && (toAdd > 0)) { | while ( (histIdx > 0) && (toAdd > 0)) { | ||||
if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { | if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { | ||||
maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; | maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; | ||||
@@ -71,7 +73,7 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_ | |||||
/*seek max values across all gamma blocks */ | /*seek max values across all gamma blocks */ | ||||
allBlockMaxSumst = maxMut[0]; | allBlockMaxSumst = maxMut[0]; | ||||
allBlockMaxSumstMinusOne = maxMutMinusOne[0]; | allBlockMaxSumstMinusOne = maxMutMinusOne[0]; | ||||
for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { | |||||
for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { | |||||
allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? | allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? | ||||
maxMut[gammaBlockRowIdx] : | maxMut[gammaBlockRowIdx] : | ||||
allBlockMaxSumst; | allBlockMaxSumst; | ||||
@@ -52,7 +52,7 @@ static void gf2x_mul1(DIGIT *R, const DIGIT A, const DIGIT B) { | |||||
R[0] = 0; | R[0] = 0; | ||||
R[1] = (A & 1) * B; | R[1] = (A & 1) * B; | ||||
for (unsigned i = 1; i < DIGIT_SIZE_b; i++) { | |||||
for (uint8_t i = 1; i < DIGIT_SIZE_b; i++) { | |||||
tmp = ((A >> i) & 1) * B; | tmp = ((A >> i) & 1) * B; | ||||
R[1] ^= tmp << i; | R[1] ^= tmp << i; | ||||
R[0] ^= tmp >> (DIGIT_SIZE_b - i); | R[0] ^= tmp >> (DIGIT_SIZE_b - i); | ||||
@@ -5,39 +5,39 @@ | |||||
#include <string.h> // memcpy(...), memset(...) | #include <string.h> // memcpy(...), memset(...) | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { | void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { | ||||
for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { | |||||
for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
dest[i] = in[i]; | dest[i] = in[i]; | ||||
} | } | ||||
} | } | ||||
/* returns the coefficient of the x^exponent term as the LSB of a digit */ | /* returns the coefficient of the x^exponent term as the LSB of a digit */ | ||||
DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) { | |||||
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent) { | |||||
size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
size_t digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; | return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; | ||||
} | } | ||||
/* sets the coefficient of the x^exponent term as the LSB of a digit */ | /* sets the coefficient of the x^exponent term as the LSB of a digit */ | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) { | |||||
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value) { | |||||
size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
size_t digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
/* clear given coefficient */ | /* clear given coefficient */ | ||||
DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
DIGIT mask = ~(((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
poly[digitIdx] = poly[digitIdx] & mask; | poly[digitIdx] = poly[digitIdx] & mask; | ||||
poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
poly[digitIdx] = poly[digitIdx] | ((value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
} | } | ||||
/* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ | /* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) { | |||||
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent) { | |||||
size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; | |||||
size_t digitIdx = straightIdx / DIGIT_SIZE_b; | |||||
size_t inDigitIdx = straightIdx % DIGIT_SIZE_b; | |||||
/* clear given coefficient */ | /* clear given coefficient */ | ||||
DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
DIGIT mask = (((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); | |||||
poly[digitIdx] = poly[digitIdx] ^ mask; | poly[digitIdx] = poly[digitIdx] ^ mask; | ||||
} | } | ||||
@@ -51,7 +51,7 @@ static int popcount_uint64t(uint64_t x) { | |||||
} | } | ||||
/* population count for a single polynomial */ | /* population count for a single polynomial */ | ||||
int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(DIGIT *poly) { | |||||
int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(const DIGIT *poly) { | |||||
int ret = 0; | int ret = 0; | ||||
for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { | for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { | ||||
ret += popcount_uint64t(poly[i]); | ret += popcount_uint64t(poly[i]); | ||||
@@ -74,10 +74,9 @@ static void gf2x_mod(DIGIT out[], const DIGIT in[]) { | |||||
out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1; | out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1; | ||||
} | } | ||||
static void right_bit_shift(unsigned int length, DIGIT in[]) { | |||||
unsigned int j; | |||||
for (j = length - 1; j > 0 ; j--) { | |||||
static void right_bit_shift(size_t length, DIGIT in[]) { | |||||
size_t j; | |||||
for (j = length - 1; j > 0; j--) { | |||||
in[j] >>= 1; | in[j] >>= 1; | ||||
in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); | in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); | ||||
} | } | ||||
@@ -86,8 +85,8 @@ static void right_bit_shift(unsigned int length, DIGIT in[]) { | |||||
/* shifts by whole digits */ | /* shifts by whole digits */ | ||||
static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) { | |||||
unsigned int j; | |||||
static void left_DIGIT_shift_n(size_t length, DIGIT in[], size_t amount) { | |||||
size_t j; | |||||
for (j = 0; (j + amount) < length; j++) { | for (j = 0; (j + amount) < length; j++) { | ||||
in[j] = in[j + amount]; | in[j] = in[j + amount]; | ||||
} | } | ||||
@@ -97,7 +96,7 @@ static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amo | |||||
} | } | ||||
/* may shift by an arbitrary amount*/ | /* may shift by an arbitrary amount*/ | ||||
static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) { | |||||
static void left_bit_shift_wide_n(size_t length, DIGIT in[], size_t amount) { | |||||
left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); | left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); | PQCLEAN_LEDAKEMLT52_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); | ||||
} | } | ||||
@@ -123,18 +122,22 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) { | |||||
DIGIT mask = (DIGIT)0x1; | DIGIT mask = (DIGIT)0x1; | ||||
DIGIT rev1, rev2, a00; | DIGIT rev1, rev2, a00; | ||||
int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; | |||||
int slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; | |||||
a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; | a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; | ||||
right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); | right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); | ||||
for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { | |||||
for (size_t i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { | |||||
rev1 = reverse_digit(A[i]); | rev1 = reverse_digit(A[i]); | ||||
rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); | rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); | ||||
A[i] = rev2; | A[i] = rev2; | ||||
A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; | A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; | ||||
} | } | ||||
if (NUM_DIGITS_GF2X_ELEMENT % 2 == 1) { | |||||
A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]); | |||||
} | |||||
if (slack_bits_amount) { | if (slack_bits_amount) { | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); | PQCLEAN_LEDAKEMLT52_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); | ||||
} | } | ||||
@@ -151,10 +154,9 @@ static void rotate_bit_right(DIGIT in[]) { /* x^{-1} * in(x) mod x^P+1 */ | |||||
} | } | ||||
/* cond swap: swaps digits A and B if swap_mask == -1 */ | /* cond swap: swaps digits A and B if swap_mask == -1 */ | ||||
static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { | |||||
int i; | |||||
static void gf2x_cswap(DIGIT *a, DIGIT *b, int32_t swap_mask) { | |||||
DIGIT t; | DIGIT t; | ||||
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
t = swap_mask & (a[i] ^ b[i]); | t = swap_mask & (a[i] ^ b[i]); | ||||
a[i] ^= t; | a[i] ^= t; | ||||
b[i] ^= t; | b[i] ^= t; | ||||
@@ -162,18 +164,18 @@ static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { | |||||
} | } | ||||
/* returns -1 mask if x != 0, otherwise 0 */ | /* returns -1 mask if x != 0, otherwise 0 */ | ||||
static inline int nonzero(DIGIT x) { | |||||
static inline int32_t nonzero(DIGIT x) { | |||||
DIGIT t = x; | DIGIT t = x; | ||||
t = (~t) + 1; | t = (~t) + 1; | ||||
t >>= DIGIT_SIZE_b - 1; | t >>= DIGIT_SIZE_b - 1; | ||||
return -((int)t); | |||||
return -((int32_t)t); | |||||
} | } | ||||
/* returns -1 mask if x < 0 else 0 */ | /* returns -1 mask if x < 0 else 0 */ | ||||
static inline int negative(int x) { | |||||
static inline int32_t negative(int x) { | |||||
uint32_t u = x; | uint32_t u = x; | ||||
u >>= 31; | u >>= 31; | ||||
return -((int)u); | |||||
return -((int32_t)u); | |||||
} | } | ||||
/* return f(0) as digit */ | /* return f(0) as digit */ | ||||
@@ -191,7 +193,7 @@ static void gf2x_mult_scalar_acc(DIGIT *f, const DIGIT *g, const DIGIT s) { | |||||
/* constant-time inverse, source: gcd.cr.yp.to */ | /* constant-time inverse, source: gcd.cr.yp.to */ | ||||
int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { | int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { | ||||
int i, loop, swap, delta = 1; | |||||
int32_t swap, delta = 1; | |||||
DIGIT g0_mask; | DIGIT g0_mask; | ||||
DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1 | DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1 | ||||
@@ -202,17 +204,17 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) | |||||
f[NUM_DIGITS_GF2X_MODULUS - 1] = 1; | f[NUM_DIGITS_GF2X_MODULUS - 1] = 1; | ||||
f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); | f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); | ||||
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
g[i] = in[i]; | g[i] = in[i]; | ||||
} | } | ||||
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { | |||||
v[i] = 0; | v[i] = 0; | ||||
} | } | ||||
r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1; | r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1; | ||||
for (loop = 0; loop < 2 * P - 1; ++loop) { | |||||
for (int loop = 0; loop < 2 * P - 1; ++loop) { | |||||
swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0 | swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0 | ||||
delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap | delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap | ||||
@@ -247,7 +249,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], con | |||||
/*PRE: the representation of the sparse coefficients is sorted in increasing | /*PRE: the representation of the sparse coefficients is sorted in increasing | ||||
order of the coefficients themselves */ | order of the coefficients themselves */ | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], | void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], | ||||
POSITION_T sparse[], unsigned int nPos) { | |||||
POSITION_T sparse[], size_t nPos) { | |||||
DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; | DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; | ||||
DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; | DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; | ||||
@@ -258,7 +260,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons | |||||
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); | left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); | ||||
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); | left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); | ||||
for (unsigned int i = 1; i < nPos; i++) { | |||||
for (size_t i = 1; i < nPos; i++) { | |||||
if (sparse[i] != INVALID_POS_VALUE) { | if (sparse[i] != INVALID_POS_VALUE) { | ||||
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); | left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); | PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); | ||||
@@ -270,10 +272,9 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons | |||||
} | } | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) { | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]) { | |||||
POSITION_T t; | POSITION_T t; | ||||
int i = 0, j; | |||||
size_t i = 0, j; | |||||
if (A[i] == 0) { | if (A[i] == 0) { | ||||
i = 1; | i = 1; | ||||
@@ -297,6 +298,9 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R | |||||
size_t sizeB, const POSITION_T B[]) { | size_t sizeB, const POSITION_T B[]) { | ||||
POSITION_T prod; | POSITION_T prod; | ||||
POSITION_T lastReadPos; | |||||
size_t duplicateCount; | |||||
size_t write_idx, read_idx; | |||||
/* compute all the coefficients, filling invalid positions with P*/ | /* compute all the coefficients, filling invalid positions with P*/ | ||||
size_t lastFilledPos = 0; | size_t lastFilledPos = 0; | ||||
@@ -317,12 +321,11 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R | |||||
Res[lastFilledPos] = INVALID_POS_VALUE; | Res[lastFilledPos] = INVALID_POS_VALUE; | ||||
lastFilledPos++; | lastFilledPos++; | ||||
} | } | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(Res, sizeR); | PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(Res, sizeR); | ||||
/* eliminate duplicates */ | /* eliminate duplicates */ | ||||
POSITION_T lastReadPos = Res[0]; | |||||
size_t duplicateCount; | |||||
size_t write_idx = 0; | |||||
size_t read_idx = 0; | |||||
write_idx = read_idx = 0; | |||||
while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { | while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { | ||||
lastReadPos = Res[read_idx]; | lastReadPos = Res[read_idx]; | ||||
read_idx++; | read_idx++; | ||||
@@ -344,13 +347,12 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R | |||||
/* the implementation is safe even in case A or B alias with the result | /* the implementation is safe even in case A or B alias with the result | ||||
* PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ | * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse( | |||||
int sizeR, POSITION_T Res[], | |||||
int sizeA, const POSITION_T A[], | |||||
int sizeB, const POSITION_T B[]) { | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], | |||||
size_t sizeA, const POSITION_T A[], | |||||
size_t sizeB, const POSITION_T B[]) { | |||||
POSITION_T tmpRes[DV * M]; | POSITION_T tmpRes[DV * M]; | ||||
int idxA = 0, idxB = 0, idxR = 0; | |||||
size_t idxA = 0, idxB = 0, idxR = 0; | |||||
while ( idxA < sizeA && | while ( idxA < sizeA && | ||||
idxB < sizeB && | idxB < sizeB && | ||||
A[idxA] != INVALID_POS_VALUE && | A[idxA] != INVALID_POS_VALUE && | ||||
@@ -419,18 +421,18 @@ static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct | |||||
/* Obtains fresh randomness and seed-expands it until all the required positions | /* Obtains fresh randomness and seed-expands it until all the required positions | ||||
* for the '1's in the circulant block are obtained */ | * for the '1's in the circulant block are obtained */ | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, | void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, | ||||
int countOnes, | |||||
size_t countOnes, | |||||
AES_XOF_struct *seed_expander_ctx) { | AES_XOF_struct *seed_expander_ctx) { | ||||
int duplicated, placedOnes = 0; | |||||
uint32_t p; | |||||
size_t duplicated, placedOnes = 0; | |||||
POSITION_T p; | |||||
while (placedOnes < countOnes) { | while (placedOnes < countOnes) { | ||||
p = rand_range(NUM_BITS_GF2X_ELEMENT, | p = rand_range(NUM_BITS_GF2X_ELEMENT, | ||||
P_BITS, | P_BITS, | ||||
seed_expander_ctx); | seed_expander_ctx); | ||||
duplicated = 0; | duplicated = 0; | ||||
for (int j = 0; j < placedOnes; j++) { | |||||
for (size_t j = 0; j < placedOnes; j++) { | |||||
if (pos_ones[j] == p) { | if (pos_ones[j] == p) { | ||||
duplicated = 1; | duplicated = 1; | ||||
} | } | ||||
@@ -16,22 +16,22 @@ | |||||
#define P_BITS (18) | #define P_BITS (18) | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); | void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); | ||||
DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent); | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value); | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent); | |||||
int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(DIGIT *poly); | |||||
DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent); | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value); | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent); | |||||
int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(const DIGIT *poly); | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); | void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); | void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); | void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx); | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, size_t countOnes, AES_XOF_struct *seed_expander_ctx); | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); | void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx); | void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx); | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]); | void PQCLEAN_LEDAKEMLT52_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]); | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]); | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]); | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]); | |||||
int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); | int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); | void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos); | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], size_t nPos); | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); | void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); | void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); | ||||
@@ -107,18 +107,19 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, | |||||
uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH]; | uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH]; | ||||
uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0}; | uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0}; | ||||
uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0}; | uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0}; | ||||
int decode_ok, decrypt_ok, equal; | |||||
unpack_ct(syndrome, ct); | unpack_ct(syndrome, ct); | ||||
int decode_ok = PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(decoded_error_vector, | |||||
(const privateKeyNiederreiter_t *)sk, syndrome); | |||||
decode_ok = PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(decoded_error_vector, | |||||
(const privateKeyNiederreiter_t *)sk, syndrome); | |||||
pack_error(decoded_error_bytes, decoded_error_vector); | pack_error(decoded_error_bytes, decoded_error_vector); | ||||
HASH_FUNCTION(hashedErrorVector, decoded_error_bytes, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | HASH_FUNCTION(hashedErrorVector, decoded_error_bytes, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | ||||
memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH); | memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH); | ||||
for (int i = 0; i < TRNG_BYTE_LENGTH; ++i) { | |||||
for (size_t i = 0; i < TRNG_BYTE_LENGTH; ++i) { | |||||
decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^ | decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^ | ||||
hashedAndTruncatedErrorVector[i]; | hashedAndTruncatedErrorVector[i]; | ||||
} | } | ||||
@@ -135,11 +136,11 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, | |||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos); | PQCLEAN_LEDAKEMLT52_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos); | ||||
int equal = PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_verify(decoded_error_vector, | |||||
reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); | |||||
equal = PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_verify(decoded_error_vector, | |||||
reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); | |||||
// equal == 0, if the reconstructed error vector match !!! | // equal == 0, if the reconstructed error vector match !!! | ||||
int decryptOk = (decode_ok == 1 && equal == 0); | |||||
decrypt_ok = (decode_ok == 1 && equal == 0); | |||||
memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH); | memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH); | ||||
memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH); | memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH); | ||||
@@ -148,7 +149,7 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, | |||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_cmov(ss_input + sizeof(decoded_seed), | PQCLEAN_LEDAKEMLT52_LEAKTIME_cmov(ss_input + sizeof(decoded_seed), | ||||
((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret, | ((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret, | ||||
TRNG_BYTE_LENGTH, | TRNG_BYTE_LENGTH, | ||||
!decryptOk); | |||||
!decrypt_ok); | |||||
HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH); | HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH); | ||||
@@ -49,7 +49,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p | |||||
} | } | ||||
} | } | ||||
is_L_full = 1; | is_L_full = 1; | ||||
for (int i = 0; i < N0; i++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); | is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); | ||||
} | } | ||||
sk->rejections = sk->rejections + 1; | sk->rejections = sk->rejections + 1; | ||||
@@ -63,21 +63,21 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p | |||||
sk->decryption_failure_secret, | sk->decryption_failure_secret, | ||||
(unsigned long)TRNG_BYTE_LENGTH); | (unsigned long)TRNG_BYTE_LENGTH); | ||||
for (int j = 0; j < DV * M; j++) { | |||||
for (size_t j = 0; j < DV * M; j++) { | |||||
if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { | if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); | PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); | ||||
} | } | ||||
} | } | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); | PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); | ||||
for (int i = 0; i < N0 - 1; i++) { | |||||
for (size_t i = 0; i < N0 - 1; i++) { | |||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, | PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, | ||||
Ln0Inv, | Ln0Inv, | ||||
LPosOnes[i], | LPosOnes[i], | ||||
DV * M); | DV * M); | ||||
} | } | ||||
for (int i = 0; i < N0 - 1; i++) { | |||||
for (size_t i = 0; i < N0 - 1; i++) { | |||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); | PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); | ||||
} | } | ||||
} | } | ||||
@@ -110,24 +110,27 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK | |||||
POSITION_T auxSparse[DV * M]; | POSITION_T auxSparse[DV * M]; | ||||
POSITION_T Ln0trSparse[DV * M]; | POSITION_T Ln0trSparse[DV * M]; | ||||
DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0}; | DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0}; | ||||
DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; | |||||
DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; | DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; | ||||
unsigned char processedQOnes[N0]; | |||||
uint8_t processedQOnes[N0]; | |||||
int rejections = sk->rejections; | int rejections = sk->rejections; | ||||
int decrypt_ok = 0; | |||||
int err_weight; | |||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); | PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); | ||||
do { | do { | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander); | PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander); | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander); | PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander); | ||||
for (int i = 0; i < N0; i++) { | |||||
for (int j = 0; j < DV * M; j++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
for (size_t j = 0; j < DV * M; j++) { | |||||
LPosOnes[i][j] = INVALID_POS_VALUE; | LPosOnes[i][j] = INVALID_POS_VALUE; | ||||
} | } | ||||
} | } | ||||
memset(processedQOnes, 0x00, sizeof(processedQOnes)); | memset(processedQOnes, 0x00, sizeof(processedQOnes)); | ||||
for (int colQ = 0; colQ < N0; colQ++) { | |||||
for (int i = 0; i < N0; i++) { | |||||
for (size_t colQ = 0; colQ < N0; colQ++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, | PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, | ||||
DV, HPosOnes[i], | DV, HPosOnes[i], | ||||
qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); | qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); | ||||
@@ -143,15 +146,15 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK | |||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes); | PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes); | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes); | PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes); | ||||
for (int i = 0; i < DV * M; i++) { | |||||
for (size_t i = 0; i < DV * M; i++) { | |||||
Ln0trSparse[i] = INVALID_POS_VALUE; | Ln0trSparse[i] = INVALID_POS_VALUE; | ||||
auxSparse[i] = INVALID_POS_VALUE; | auxSparse[i] = INVALID_POS_VALUE; | ||||
} | } | ||||
for (int i = 0; i < N0; i++) { | |||||
for (size_t i = 0; i < N0; i++) { | |||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, | PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, | ||||
DV, HPosOnes[i], | DV, HPosOnes[i], | ||||
qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1] ] ); | |||||
qBlockWeights[i][N0 - 1], &QPosOnes[i][M - qBlockWeights[i][N0 - 1]]); | |||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, | PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, | ||||
DV * M, Ln0trSparse, | DV * M, Ln0trSparse, | ||||
DV * M, auxSparse); | DV * M, auxSparse); | ||||
@@ -163,28 +166,27 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK | |||||
Ln0trSparse, | Ln0trSparse, | ||||
DV * M); | DV * M); | ||||
int decryptOk = 0; | |||||
decryptOk = PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(err_computed, | |||||
(const POSITION_T (*)[DV]) HtrPosOnes, | |||||
(const POSITION_T (*)[M]) QtrPosOnes, | |||||
privateSyndrome, sk->secondIterThreshold); | |||||
decrypt_ok = PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(err_computed, | |||||
(const POSITION_T (*)[DV]) HtrPosOnes, | |||||
(const POSITION_T (*)[M]) QtrPosOnes, | |||||
privateSyndrome, sk->secondIterThreshold); | |||||
int err_weight = 0; | |||||
for (int i = 0 ; i < N0; i++) { | |||||
err_weight = 0; | |||||
for (size_t i = 0 ; i < N0; i++) { | |||||
err_weight += PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i)); | err_weight += PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i)); | ||||
} | } | ||||
decryptOk = decryptOk && (err_weight == NUM_ERRORS_T); | |||||
decrypt_ok = decrypt_ok && (err_weight == NUM_ERRORS_T); | |||||
/* prepare mockup error vector in case a decoding failure occurs */ | /* prepare mockup error vector in case a decoding failure occurs */ | ||||
DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; | |||||
memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | ||||
memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH); | memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH); | ||||
memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00, | memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00, | ||||
(N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH); | (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH); | ||||
memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); | ||||
// Overwrite on decryption failure | // Overwrite on decryption failure | ||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decryptOk); | |||||
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decrypt_ok); | |||||
return decryptOk; | |||||
return decrypt_ok; | |||||
} | } |
@@ -13,8 +13,8 @@ | |||||
maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier | maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier | ||||
*/ | */ | ||||
static void seedexpander_init(AES_XOF_struct *ctx, | static void seedexpander_init(AES_XOF_struct *ctx, | ||||
unsigned char *seed, | |||||
unsigned char *diversifier, | |||||
uint8_t *seed, | |||||
uint8_t *diversifier, | |||||
size_t maxlen) { | size_t maxlen) { | ||||
ctx->length_remaining = maxlen; | ctx->length_remaining = maxlen; | ||||
@@ -38,13 +38,13 @@ static void seedexpander_init(AES_XOF_struct *ctx, | |||||
} | } | ||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, | void PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, | ||||
const unsigned char *trng_entropy | |||||
const uint8_t *trng_entropy | |||||
/* TRNG_BYTE_LENGTH wide buffer */) { | /* TRNG_BYTE_LENGTH wide buffer */) { | ||||
/*the NIST seedexpander will however access 32B from this buffer */ | /*the NIST seedexpander will however access 32B from this buffer */ | ||||
unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; | unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; | ||||
unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 }; | |||||
unsigned char *diversifier = ((unsigned char *)trng_entropy) + 32; | |||||
uint8_t prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = {0x00}; | |||||
uint8_t *diversifier = (uint8_t *)trng_entropy + 32; | |||||
memcpy(prng_buffer, | memcpy(prng_buffer, | ||||
trng_entropy, | trng_entropy, | ||||
@@ -61,7 +61,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, | |||||
x - returns the XOF data | x - returns the XOF data | ||||
xlen - number of bytes to return | xlen - number of bytes to return | ||||
*/ | */ | ||||
int PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) { | |||||
int PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(AES_XOF_struct *ctx, uint8_t *x, size_t xlen) { | |||||
size_t offset; | size_t offset; | ||||
aes256ctx ctx256; | aes256ctx ctx256; | ||||
@@ -5,6 +5,17 @@ | |||||
Source: https://sorting.cr.yp.to | Source: https://sorting.cr.yp.to | ||||
*/ | */ | ||||
#define int32_MINMAX(a,b) \ | |||||
do { \ | |||||
int32 ab = (b) ^ (a); \ | |||||
int32 c = (b) - (a); \ | |||||
c ^= ab & (c ^ (b)); \ | |||||
c >>= 31; \ | |||||
c &= ab; \ | |||||
(a) ^= c; \ | |||||
(b) ^= c; \ | |||||
} while(0) | |||||
static void int32_sort(int32 *x, size_t n) { | static void int32_sort(int32 *x, size_t n) { | ||||
size_t top, p, q, r, i, j; | size_t top, p, q, r, i, j; | ||||
@@ -6,17 +6,6 @@ | |||||
#define int32 int32_t | #define int32 int32_t | ||||
#define int32_MINMAX(a,b) \ | |||||
do { \ | |||||
int32 ab = (b) ^ (a); \ | |||||
int32 c = (b) - (a); \ | |||||
c ^= ab & (c ^ (b)); \ | |||||
c >>= 31; \ | |||||
c &= ab; \ | |||||
(a) ^= c; \ | |||||
(b) ^= c; \ | |||||
} while(0) | |||||
void PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(uint32_t *x, size_t n); | void PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(uint32_t *x, size_t n); | ||||
#endif | #endif |
@@ -7,6 +7,7 @@ consistency_checks: | |||||
- dfr_test.c | - dfr_test.c | ||||
- dfr_test.h | - dfr_test.h | ||||
- gf2x_arith.c | - gf2x_arith.c | ||||
- gf2x_arith_mod_xPplusOne.c | |||||
- H_Q_matrices_generation.c | - H_Q_matrices_generation.c | ||||
- H_Q_matrices_generation.h | - H_Q_matrices_generation.h | ||||
- kem.c | - kem.c | ||||
@@ -24,6 +25,7 @@ consistency_checks: | |||||
- dfr_test.c | - dfr_test.c | ||||
- dfr_test.h | - dfr_test.h | ||||
- gf2x_arith.c | - gf2x_arith.c | ||||
- gf2x_arith_mod_xPplusOne.c | |||||
- H_Q_matrices_generation.c | - H_Q_matrices_generation.c | ||||
- H_Q_matrices_generation.h | - H_Q_matrices_generation.h | ||||
- kem.c | - kem.c | ||||
@@ -32,4 +34,3 @@ consistency_checks: | |||||
- rng.h | - rng.h | ||||
- utils.c | - utils.c | ||||
- utils.h | - utils.h | ||||
@@ -7,6 +7,7 @@ consistency_checks: | |||||
- dfr_test.c | - dfr_test.c | ||||
- dfr_test.h | - dfr_test.h | ||||
- gf2x_arith.c | - gf2x_arith.c | ||||
- gf2x_arith_mod_xPplusOne.c | |||||
- H_Q_matrices_generation.c | - H_Q_matrices_generation.c | ||||
- H_Q_matrices_generation.h | - H_Q_matrices_generation.h | ||||
- kem.c | - kem.c | ||||
@@ -24,6 +25,7 @@ consistency_checks: | |||||
- dfr_test.c | - dfr_test.c | ||||
- dfr_test.h | - dfr_test.h | ||||
- gf2x_arith.c | - gf2x_arith.c | ||||
- gf2x_arith_mod_xPplusOne.c | |||||
- H_Q_matrices_generation.c | - H_Q_matrices_generation.c | ||||
- H_Q_matrices_generation.h | - H_Q_matrices_generation.h | ||||
- kem.c | - kem.c | ||||
@@ -32,4 +34,3 @@ consistency_checks: | |||||
- rng.h | - rng.h | ||||
- utils.c | - utils.c | ||||
- utils.h | - utils.h | ||||
@@ -7,6 +7,7 @@ consistency_checks: | |||||
- dfr_test.c | - dfr_test.c | ||||
- dfr_test.h | - dfr_test.h | ||||
- gf2x_arith.c | - gf2x_arith.c | ||||
- gf2x_arith_mod_xPplusOne.c | |||||
- H_Q_matrices_generation.c | - H_Q_matrices_generation.c | ||||
- H_Q_matrices_generation.h | - H_Q_matrices_generation.h | ||||
- kem.c | - kem.c | ||||
@@ -32,4 +33,3 @@ consistency_checks: | |||||
- rng.h | - rng.h | ||||
- utils.c | - utils.c | ||||
- utils.h | - utils.h | ||||