kris/pqcrypto
1
1
Fork 0
mirror of https://github.com/henrydcase/pqc.git synced 2024-11-26 09:21:28 +00:00
Code Issues 1 Releases Wiki Activity

fix requested changes

Browse Source
This commit is contained in:
Leon Botros 2019-08-24 15:48:38 +02:00
parent 823ba3f13b
commit 9dd4a4b5da
36 changed files with 544 additions and 532 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
crypto_kem/ledakemlt12/leaktime/H_Q_matrices_generation.c
View File

@ -1,23 +1,19 @@
#include "H_Q_matrices_generation.h" #include "H_Q_matrices_generation.h"
#include "gf2x_arith_mod_xPplusOne.h" #include "gf2x_arith_mod_xPplusOne.h"
void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], AES_XOF_struct *keys_expander) {
AES_XOF_struct *keys_expander) { for (size_t i = 0; i < N0; i++) {
for (int i = 0; i < N0; i++) {
/* Generate a random block of Htr */ /* Generate a random block of Htr */
PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], DV, keys_expander);
DV,
keys_expander);
} }
} }
void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], AES_XOF_struct *keys_expander) {
AES_XOF_struct *keys_expander) { size_t placed_ones;
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
int placed_ones = 0; placed_ones = 0;
for (int j = 0; j < N0; j++) { for (size_t j = 0; j < N0; j++) {
PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones], PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones],
qBlockWeights[i][j], qBlockWeights[i][j],
keys_expander); keys_expander);
@ -26,29 +22,27 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M],
} }
} }
void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], /* output*/ void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], POSITION_T HPosOnes[N0][DV]) {
POSITION_T HPosOnes[N0][DV]) { for (size_t i = 0; i < N0; i++) {
for (int i = 0; i < N0; i++) {
/* Obtain directly the sparse representation of the block of H */ /* Obtain directly the sparse representation of the block of H */
for (int k = 0; k < DV; k++) { for (size_t k = 0; k < DV; k++) {
HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */ HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */
}// end for k }
} }
} }
void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], /* output*/ void PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], POSITION_T QPosOnes[N0][M]) {
POSITION_T QPosOnes[N0][M]) { POSITION_T transposed_ones_idx[N0] = {0x00};
size_t currQoneIdx, endQblockIdx;
unsigned transposed_ones_idx[N0] = {0x00}; for (size_t source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) {
for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { currQoneIdx = 0; // position in the column of QtrPosOnes[][...]
int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] endQblockIdx = 0;
int endQblockIdx = 0;
for (int blockIdx = 0; blockIdx < N0; blockIdx++) { for (int blockIdx = 0; blockIdx < N0; blockIdx++) {
endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; endQblockIdx += qBlockWeights[source_row_idx][blockIdx];
for (; currQoneIdx < endQblockIdx; currQoneIdx++) { for (; currQoneIdx < endQblockIdx; currQoneIdx++) {
QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P - QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] =
QPosOnes[source_row_idx][currQoneIdx]) % P; (P - QPosOnes[source_row_idx][currQoneIdx]) % P;
transposed_ones_idx[blockIdx]++; transposed_ones_idx[blockIdx]++;
} }
} }

45
crypto_kem/ledakemlt12/leaktime/bf_decoding.c
View File

@ -7,22 +7,26 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(DIGIT err[],
const POSITION_T HtrPosOnes[N0][DV], const POSITION_T HtrPosOnes[N0][DV],
const POSITION_T QtrPosOnes[N0][M], const POSITION_T QtrPosOnes[N0][M],
DIGIT privateSyndrome[], DIGIT privateSyndrome[],
uint8_t threshold) { uint8_t secondIterThreshold) {
DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT];
uint8_t unsatParityChecks[N0 * P]; uint8_t unsatParityChecks[N0 * P];
POSITION_T currQBlkPos[M], currQBitPos[M]; POSITION_T currQBlkPos[M], currQBitPos[M];
DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; POSITION_T syndromePosToFlip, tmp;
unsigned int correlation, corrt_syndrome_based;
size_t currQoneIdx, endQblockIdx, currblockoffset;
int check; int check;
int iteration = 0; int iteration = 0;
unsigned int corrt_syndrome_based;
do { do {
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome);
memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t));
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
for (int valueIdx = 0; valueIdx < P; valueIdx++) { for (size_t valueIdx = 0; valueIdx < P; valueIdx++) {
for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx); tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ?
(HtrPosOnes[i][HtrOneIdx] + valueIdx) - P :
(HtrPosOnes[i][HtrOneIdx] + valueIdx);
if (PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { if (PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) {
unsatParityChecks[i * P + valueIdx]++; unsatParityChecks[i * P + valueIdx]++;
} }
@ -31,33 +35,32 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(DIGIT err[],
} }
/* iteration based threshold determination*/ /* iteration based threshold determination*/
corrt_syndrome_based = iteration ? (unsigned int) threshold : B0; corrt_syndrome_based = iteration * secondIterThreshold + (1 - iteration) * B0;
//Computation of correlation with a full Q matrix // Computation of correlation with a full Q matrix
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
for (int j = 0; j < P; j++) { for (size_t j = 0; j < P; j++) {
int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] currQoneIdx = endQblockIdx = 0;
int endQblockIdx = 0; correlation = 0;
unsigned int correlation = 0;
for (int blockIdx = 0; blockIdx < N0; blockIdx++) { for (size_t blockIdx = 0; blockIdx < N0; blockIdx++) {
endQblockIdx += qBlockWeights[blockIdx][i]; endQblockIdx += qBlockWeights[blockIdx][i];
int currblockoffset = blockIdx * P; currblockoffset = blockIdx * P;
for (; currQoneIdx < endQblockIdx; currQoneIdx++) { for (; currQoneIdx < endQblockIdx; currQoneIdx++) {
POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j; tmp = QtrPosOnes[i][currQoneIdx] + j;
tmp = tmp >= P ? tmp - P : tmp; tmp = tmp >= P ? tmp - P : tmp;
currQBitPos[currQoneIdx] = tmp; currQBitPos[currQoneIdx] = tmp;
currQBlkPos[currQoneIdx] = blockIdx; currQBlkPos[currQoneIdx] = blockIdx;
correlation += unsatParityChecks[tmp + currblockoffset]; correlation += unsatParityChecks[tmp + currblockoffset];
} }
} }
/* Correlation based flipping */ /* Correlation based flipping */
if (correlation >= corrt_syndrome_based) { if (correlation >= corrt_syndrome_based) {
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j);
for (int v = 0; v < M; v++) { for (size_t v = 0; v < M; v++) {
POSITION_T syndromePosToFlip; for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v]);
syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] );
syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip;
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip);
} }

36
crypto_kem/ledakemlt12/leaktime/dfr_test.c
View File

@ -14,47 +14,49 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_
unsigned int maxMut[N0], maxMutMinusOne[N0]; unsigned int maxMut[N0], maxMutMinusOne[N0];
unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne;
unsigned int gammaHist[N0][DV * M + 1] = {{0}}; unsigned int gammaHist[N0][DV * M + 1] = {{0}};
unsigned int toAdd;
size_t histIdx;
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
for (int j = 0; j < DV * M; j++) { for (size_t j = 0; j < DV * M; j++) {
if (LSparse[i][j] != 0) { if (LSparse[i][j] != 0) {
LSparse_loc[i][j] = (P - LSparse[i][j]) ; LSparse_loc[i][j] = (P - LSparse[i][j]);
} }
} }
PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M); PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M);
} }
for (int i = 0; i < N0; i++ ) { for (size_t i = 0; i < N0; i++ ) {
for (int j = 0; j < N0; j++ ) { for (size_t j = 0; j < N0; j++) {
for (int k = 0; k < (DV * M); k++) { for (size_t k = 0; k < (DV * M); k++) {
for (int l = 0; l < (DV * M); l++) { for (size_t l = 0; l < (DV * M); l++) {
gamma[i][j][ (P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P ]++; gamma[i][j][(P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P]++;
} }
} }
} }
} }
for (int i = 0; i < N0; i++ ) { for (size_t i = 0; i < N0; i++ ) {
for (int j = 0; j < N0; j++ ) { for (size_t j = 0; j < N0; j++ ) {
gamma[i][j][0] = 0; gamma[i][j][0] = 0;
} }
} }
/* build histogram of values in gamma */ /* build histogram of values in gamma */
for (int i = 0; i < N0; i++ ) { for (size_t i = 0; i < N0; i++ ) {
for (int j = 0; j < N0; j++ ) { for (size_t j = 0; j < N0; j++ ) {
for (int k = 0; k < P; k++) { for (size_t k = 0; k < P; k++) {
gammaHist[i][gamma[i][j][k]]++; gammaHist[i][gamma[i][j][k]]++;
} }
} }
} }
for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) {
unsigned int toAdd = T_BAR - 1;
maxMutMinusOne[gammaBlockRowIdx] = 0; maxMutMinusOne[gammaBlockRowIdx] = 0;
unsigned int histIdx = DV * M; histIdx = DV * M;
toAdd = T_BAR - 1;
while ( (histIdx > 0) && (toAdd > 0)) { while ( (histIdx > 0) && (toAdd > 0)) {
if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) {
maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd;
@ -71,7 +73,7 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_
/*seek max values across all gamma blocks */ /*seek max values across all gamma blocks */
allBlockMaxSumst = maxMut[0]; allBlockMaxSumst = maxMut[0];
allBlockMaxSumstMinusOne = maxMutMinusOne[0]; allBlockMaxSumstMinusOne = maxMutMinusOne[0];
for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) {
allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ?
maxMut[gammaBlockRowIdx] : maxMut[gammaBlockRowIdx] :
allBlockMaxSumst; allBlockMaxSumst;

2
crypto_kem/ledakemlt12/leaktime/gf2x_arith.c
View File

@ -52,7 +52,7 @@ static void gf2x_mul1(DIGIT *R, const DIGIT A, const DIGIT B) {
R[0] = 0; R[0] = 0;
R[1] = (A & 1) * B; R[1] = (A & 1) * B;
for (unsigned i = 1; i < DIGIT_SIZE_b; i++) { for (uint8_t i = 1; i < DIGIT_SIZE_b; i++) {
tmp = ((A >> i) & 1) * B; tmp = ((A >> i) & 1) * B;
R[1] ^= tmp << i; R[1] ^= tmp << i;
R[0] ^= tmp >> (DIGIT_SIZE_b - i); R[0] ^= tmp >> (DIGIT_SIZE_b - i);

110
crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.c
View File

@ -5,39 +5,39 @@
#include <string.h> // memcpy(...), memset(...) #include <string.h> // memcpy(...), memset(...)
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) {
for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
dest[i] = in[i]; dest[i] = in[i];
} }
} }
/* returns the coefficient of the x^exponent term as the LSB of a digit */ /* returns the coefficient of the x^exponent term as the LSB of a digit */
DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) { DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent) {
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; size_t digitIdx = straightIdx / DIGIT_SIZE_b;
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ;
} }
/* sets the coefficient of the x^exponent term as the LSB of a digit */ /* sets the coefficient of the x^exponent term as the LSB of a digit */
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) { void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value) {
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; size_t digitIdx = straightIdx / DIGIT_SIZE_b;
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
/* clear given coefficient */ /* clear given coefficient */
DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); DIGIT mask = ~(((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
poly[digitIdx] = poly[digitIdx] & mask; poly[digitIdx] = poly[digitIdx] & mask;
poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); poly[digitIdx] = poly[digitIdx] | ((value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx));
} }
/* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ /* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) { void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent) {
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; size_t digitIdx = straightIdx / DIGIT_SIZE_b;
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
/* clear given coefficient */ /* clear given coefficient */
DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); DIGIT mask = (((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
poly[digitIdx] = poly[digitIdx] ^ mask; poly[digitIdx] = poly[digitIdx] ^ mask;
} }
@ -51,7 +51,7 @@ static int popcount_uint64t(uint64_t x) {
} }
/* population count for a single polynomial */ /* population count for a single polynomial */
int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(DIGIT *poly) { int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(const DIGIT *poly) {
int ret = 0; int ret = 0;
for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) {
ret += popcount_uint64t(poly[i]); ret += popcount_uint64t(poly[i]);
@ -74,10 +74,9 @@ static void gf2x_mod(DIGIT out[], const DIGIT in[]) {
out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1; out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1;
} }
static void right_bit_shift(unsigned int length, DIGIT in[]) { static void right_bit_shift(size_t length, DIGIT in[]) {
size_t j;
unsigned int j; for (j = length - 1; j > 0; j--) {
for (j = length - 1; j > 0 ; j--) {
in[j] >>= 1; in[j] >>= 1;
in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1);
} }
@ -86,8 +85,8 @@ static void right_bit_shift(unsigned int length, DIGIT in[]) {
/* shifts by whole digits */ /* shifts by whole digits */
static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) { static void left_DIGIT_shift_n(size_t length, DIGIT in[], size_t amount) {
unsigned int j; size_t j;
for (j = 0; (j + amount) < length; j++) { for (j = 0; (j + amount) < length; j++) {
in[j] = in[j + amount]; in[j] = in[j + amount];
} }
@ -97,7 +96,7 @@ static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amo
} }
/* may shift by an arbitrary amount*/ /* may shift by an arbitrary amount*/
static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) { static void left_bit_shift_wide_n(size_t length, DIGIT in[], size_t amount) {
left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b);
PQCLEAN_LEDAKEMLT12_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); PQCLEAN_LEDAKEMLT12_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b);
} }
@ -123,19 +122,21 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) {
DIGIT mask = (DIGIT)0x1; DIGIT mask = (DIGIT)0x1;
DIGIT rev1, rev2, a00; DIGIT rev1, rev2, a00;
int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; int slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P;
a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask;
right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A);
for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { for (size_t i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) {
rev1 = reverse_digit(A[i]); rev1 = reverse_digit(A[i]);
rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]);
A[i] = rev2; A[i] = rev2;
A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1;
} }
if (NUM_DIGITS_GF2X_ELEMENT % 2 == 1) {
A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]); A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]);
}
if (slack_bits_amount) { if (slack_bits_amount) {
PQCLEAN_LEDAKEMLT12_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); PQCLEAN_LEDAKEMLT12_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount);
@ -153,10 +154,9 @@ static void rotate_bit_right(DIGIT in[]) { /* x^{-1} * in(x) mod x^P+1 */
} }
/* cond swap: swaps digits A and B if swap_mask == -1 */ /* cond swap: swaps digits A and B if swap_mask == -1 */
static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { static void gf2x_cswap(DIGIT *a, DIGIT *b, int32_t swap_mask) {
int i;
DIGIT t; DIGIT t;
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
t = swap_mask & (a[i] ^ b[i]); t = swap_mask & (a[i] ^ b[i]);
a[i] ^= t; a[i] ^= t;
b[i] ^= t; b[i] ^= t;
@ -164,18 +164,18 @@ static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) {
} }
/* returns -1 mask if x != 0, otherwise 0 */ /* returns -1 mask if x != 0, otherwise 0 */
static inline int nonzero(DIGIT x) { static inline int32_t nonzero(DIGIT x) {
DIGIT t = x; DIGIT t = x;
t = (~t) + 1; t = (~t) + 1;
t >>= DIGIT_SIZE_b - 1; t >>= DIGIT_SIZE_b - 1;
return -((int)t); return -((int32_t)t);
} }
/* returns -1 mask if x < 0 else 0 */ /* returns -1 mask if x < 0 else 0 */
static inline int negative(int x) { static inline int32_t negative(int x) {
uint32_t u = x; uint32_t u = x;
u >>= 31; u >>= 31;
return -((int)u); return -((int32_t)u);
} }
/* return f(0) as digit */ /* return f(0) as digit */
@ -193,7 +193,7 @@ static void gf2x_mult_scalar_acc(DIGIT *f, const DIGIT *g, const DIGIT s) {
/* constant-time inverse, source: gcd.cr.yp.to */ /* constant-time inverse, source: gcd.cr.yp.to */
int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) {
int i, loop, swap, delta = 1; int32_t swap, delta = 1;
DIGIT g0_mask; DIGIT g0_mask;
DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1 DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1
@ -204,17 +204,17 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[])
f[NUM_DIGITS_GF2X_MODULUS - 1] = 1; f[NUM_DIGITS_GF2X_MODULUS - 1] = 1;
f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS);
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
g[i] = in[i]; g[i] = in[i];
} }
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
v[i] = 0; v[i] = 0;
} }
r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1; r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1;
for (loop = 0; loop < 2 * P - 1; ++loop) { for (int loop = 0; loop < 2 * P - 1; ++loop) {
swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0 swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0
delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap
@ -249,7 +249,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], con
/*PRE: the representation of the sparse coefficients is sorted in increasing /*PRE: the representation of the sparse coefficients is sorted in increasing
order of the coefficients themselves */ order of the coefficients themselves */
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[],
POSITION_T sparse[], unsigned int nPos) { POSITION_T sparse[], size_t nPos) {
DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00};
DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00};
@ -260,7 +260,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]);
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]);
for (unsigned int i = 1; i < nPos; i++) { for (size_t i = 1; i < nPos; i++) {
if (sparse[i] != INVALID_POS_VALUE) { if (sparse[i] != INVALID_POS_VALUE) {
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) );
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT);
@ -272,10 +272,9 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons
} }
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) { void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]) {
POSITION_T t; POSITION_T t;
int i = 0, j; size_t i = 0, j;
if (A[i] == 0) { if (A[i] == 0) {
i = 1; i = 1;
@ -299,6 +298,9 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
size_t sizeB, const POSITION_T B[]) { size_t sizeB, const POSITION_T B[]) {
POSITION_T prod; POSITION_T prod;
POSITION_T lastReadPos;
size_t duplicateCount;
size_t write_idx, read_idx;
/* compute all the coefficients, filling invalid positions with P*/ /* compute all the coefficients, filling invalid positions with P*/
size_t lastFilledPos = 0; size_t lastFilledPos = 0;
@ -319,12 +321,11 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
Res[lastFilledPos] = INVALID_POS_VALUE; Res[lastFilledPos] = INVALID_POS_VALUE;
lastFilledPos++; lastFilledPos++;
} }
PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(Res, sizeR); PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(Res, sizeR);
/* eliminate duplicates */ /* eliminate duplicates */
POSITION_T lastReadPos = Res[0]; write_idx = read_idx = 0;
size_t duplicateCount;
size_t write_idx = 0;
size_t read_idx = 0;
while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) {
lastReadPos = Res[read_idx]; lastReadPos = Res[read_idx];
read_idx++; read_idx++;
@ -346,13 +347,12 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
/* the implementation is safe even in case A or B alias with the result /* the implementation is safe even in case A or B alias with the result
* PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse( void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[],
int sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[],
int sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]) {
int sizeB, const POSITION_T B[]) {
POSITION_T tmpRes[DV * M]; POSITION_T tmpRes[DV * M];
int idxA = 0, idxB = 0, idxR = 0; size_t idxA = 0, idxB = 0, idxR = 0;
while ( idxA < sizeA && while ( idxA < sizeA &&
idxB < sizeB && idxB < sizeB &&
A[idxA] != INVALID_POS_VALUE && A[idxA] != INVALID_POS_VALUE &&
@ -421,18 +421,18 @@ static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct
/* Obtains fresh randomness and seed-expands it until all the required positions /* Obtains fresh randomness and seed-expands it until all the required positions
* for the '1's in the circulant block are obtained */ * for the '1's in the circulant block are obtained */
void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones,
int countOnes, size_t countOnes,
AES_XOF_struct *seed_expander_ctx) { AES_XOF_struct *seed_expander_ctx) {
int duplicated, placedOnes = 0; size_t duplicated, placedOnes = 0;
uint32_t p; POSITION_T p;
while (placedOnes < countOnes) { while (placedOnes < countOnes) {
p = rand_range(NUM_BITS_GF2X_ELEMENT, p = rand_range(NUM_BITS_GF2X_ELEMENT,
P_BITS, P_BITS,
seed_expander_ctx); seed_expander_ctx);
duplicated = 0; duplicated = 0;
for (int j = 0; j < placedOnes; j++) { for (size_t j = 0; j < placedOnes; j++) {
if (pos_ones[j] == p) { if (pos_ones[j] == p) {
duplicated = 1; duplicated = 1;
} }

16
crypto_kem/ledakemlt12/leaktime/gf2x_arith_mod_xPplusOne.h
View File

@ -16,22 +16,22 @@
#define P_BITS (16) // log_2(p) = 15.6703 #define P_BITS (16) // log_2(p) = 15.6703
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]);
DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent); DIGIT PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent);
int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(DIGIT *poly); int PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(const DIGIT *poly);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, size_t countOnes, AES_XOF_struct *seed_expander_ctx);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT12_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]); void PQCLEAN_LEDAKEMLT12_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]);
int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); int PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], size_t nPos);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly);
void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); void PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes);

11
crypto_kem/ledakemlt12/leaktime/kem.c
View File

@ -107,10 +107,11 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH]; uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH];
uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0}; uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0};
uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0}; uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0};
int decode_ok, decrypt_ok, equal;
unpack_ct(syndrome, ct); unpack_ct(syndrome, ct);
int decode_ok = PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(decoded_error_vector, decode_ok = PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(decoded_error_vector,
(const privateKeyNiederreiter_t *)sk, syndrome); (const privateKeyNiederreiter_t *)sk, syndrome);
pack_error(decoded_error_bytes, decoded_error_vector); pack_error(decoded_error_bytes, decoded_error_vector);
@ -118,7 +119,7 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH); memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH);
for (int i = 0; i < TRNG_BYTE_LENGTH; ++i) { for (size_t i = 0; i < TRNG_BYTE_LENGTH; ++i) {
decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^ decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^
hashedAndTruncatedErrorVector[i]; hashedAndTruncatedErrorVector[i];
} }
@ -135,11 +136,11 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
PQCLEAN_LEDAKEMLT12_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos); PQCLEAN_LEDAKEMLT12_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos);
int equal = PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_verify(decoded_error_vector, equal = PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_verify(decoded_error_vector,
reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT);
// equal == 0, if the reconstructed error vector match !!! // equal == 0, if the reconstructed error vector match !!!
int decryptOk = (decode_ok == 1 && equal == 0); decrypt_ok = (decode_ok == 1 && equal == 0);
memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH); memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH);
memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH); memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH);
@ -148,7 +149,7 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
PQCLEAN_LEDAKEMLT12_LEAKTIME_cmov(ss_input + sizeof(decoded_seed), PQCLEAN_LEDAKEMLT12_LEAKTIME_cmov(ss_input + sizeof(decoded_seed),
((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret, ((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret,
TRNG_BYTE_LENGTH, TRNG_BYTE_LENGTH,
!decryptOk); !decrypt_ok);
HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH); HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH);

44
crypto_kem/ledakemlt12/leaktime/niederreiter.c
View File

@ -49,7 +49,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p
} }
} }
is_L_full = 1; is_L_full = 1;
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE);
} }
sk->rejections = sk->rejections + 1; sk->rejections = sk->rejections + 1;
@ -63,21 +63,21 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p
sk->decryption_failure_secret, sk->decryption_failure_secret,
(unsigned long)TRNG_BYTE_LENGTH); (unsigned long)TRNG_BYTE_LENGTH);
for (int j = 0; j < DV * M; j++) { for (size_t j = 0; j < DV * M; j++) {
if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) {
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1);
} }
} }
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense);
for (int i = 0; i < N0 - 1; i++) { for (size_t i = 0; i < N0 - 1; i++) {
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT,
Ln0Inv, Ln0Inv,
LPosOnes[i], LPosOnes[i],
DV * M); DV * M);
} }
for (int i = 0; i < N0 - 1; i++) { for (size_t i = 0; i < N0 - 1; i++) {
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT);
} }
} }
@ -110,24 +110,27 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
POSITION_T auxSparse[DV * M]; POSITION_T auxSparse[DV * M];
POSITION_T Ln0trSparse[DV * M]; POSITION_T Ln0trSparse[DV * M];
DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0}; DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0};
DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B];
DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT];
unsigned char processedQOnes[N0]; uint8_t processedQOnes[N0];
int rejections = sk->rejections; int rejections = sk->rejections;
int decrypt_ok = 0;
int err_weight;
PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed);
do { do {
PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander); PQCLEAN_LEDAKEMLT12_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander);
PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander); PQCLEAN_LEDAKEMLT12_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander);
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
for (int j = 0; j < DV * M; j++) { for (size_t j = 0; j < DV * M; j++) {
LPosOnes[i][j] = INVALID_POS_VALUE; LPosOnes[i][j] = INVALID_POS_VALUE;
} }
} }
memset(processedQOnes, 0x00, sizeof(processedQOnes)); memset(processedQOnes, 0x00, sizeof(processedQOnes));
for (int colQ = 0; colQ < N0; colQ++) { for (size_t colQ = 0; colQ < N0; colQ++) {
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes,
DV, HPosOnes[i], DV, HPosOnes[i],
qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]);
@ -143,15 +146,15 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes); PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes);
PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes); PQCLEAN_LEDAKEMLT12_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes);
for (int i = 0; i < DV * M; i++) { for (size_t i = 0; i < DV * M; i++) {
Ln0trSparse[i] = INVALID_POS_VALUE; Ln0trSparse[i] = INVALID_POS_VALUE;
auxSparse[i] = INVALID_POS_VALUE; auxSparse[i] = INVALID_POS_VALUE;
} }
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse,
DV, HPosOnes[i], DV, HPosOnes[i],
qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1] ] ); qBlockWeights[i][N0 - 1], &QPosOnes[i][M - qBlockWeights[i][N0 - 1]]);
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse,
DV * M, Ln0trSparse, DV * M, Ln0trSparse,
DV * M, auxSparse); DV * M, auxSparse);
@ -163,28 +166,27 @@ int PQCLEAN_LEDAKEMLT12_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
Ln0trSparse, Ln0trSparse,
DV * M); DV * M);
int decryptOk = 0; decrypt_ok = PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(err_computed,
decryptOk = PQCLEAN_LEDAKEMLT12_LEAKTIME_bf_decoding(err_computed,
(const POSITION_T (*)[DV]) HtrPosOnes, (const POSITION_T (*)[DV]) HtrPosOnes,
(const POSITION_T (*)[M]) QtrPosOnes, (const POSITION_T (*)[M]) QtrPosOnes,
privateSyndrome, sk->secondIterThreshold); privateSyndrome, sk->secondIterThreshold);
int err_weight = 0; err_weight = 0;
for (int i = 0 ; i < N0; i++) { for (size_t i = 0 ; i < N0; i++) {
err_weight += PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i)); err_weight += PQCLEAN_LEDAKEMLT12_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i));
} }
decryptOk = decryptOk && (err_weight == NUM_ERRORS_T); decrypt_ok = decrypt_ok && (err_weight == NUM_ERRORS_T);
/* prepare mockup error vector in case a decoding failure occurs */ /* prepare mockup error vector in case a decoding failure occurs */
DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B];
memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH); memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH);
memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00, memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00,
(N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH); (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH);
memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
// Overwrite on decryption failure
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decryptOk);
return decryptOk; // Overwrite on decryption failure
PQCLEAN_LEDAKEMLT12_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decrypt_ok);
return decrypt_ok;
} }

12
crypto_kem/ledakemlt12/leaktime/rng.c
View File

@ -13,8 +13,8 @@
maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier
*/ */
static void seedexpander_init(AES_XOF_struct *ctx, static void seedexpander_init(AES_XOF_struct *ctx,
unsigned char *seed, uint8_t *seed,
unsigned char *diversifier, uint8_t *diversifier,
size_t maxlen) { size_t maxlen) {
ctx->length_remaining = maxlen; ctx->length_remaining = maxlen;
@ -38,13 +38,13 @@ static void seedexpander_init(AES_XOF_struct *ctx,
} }
void PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, void PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx,
const unsigned char *trng_entropy const uint8_t *trng_entropy
/* TRNG_BYTE_LENGTH wide buffer */) { /* TRNG_BYTE_LENGTH wide buffer */) {
/*the NIST seedexpander will however access 32B from this buffer */ /*the NIST seedexpander will however access 32B from this buffer */
unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH;
unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 }; uint8_t prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = {0x00};
unsigned char diversifier[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; uint8_t diversifier[8] = {0};
memcpy(prng_buffer, memcpy(prng_buffer,
trng_entropy, trng_entropy,
@ -61,7 +61,7 @@ void PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx,
x - returns the XOF data x - returns the XOF data
xlen - number of bytes to return xlen - number of bytes to return
*/ */
int PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) { int PQCLEAN_LEDAKEMLT12_LEAKTIME_seedexpander(AES_XOF_struct *ctx, uint8_t *x, size_t xlen) {
size_t offset; size_t offset;
aes256ctx ctx256; aes256ctx ctx256;

11
crypto_kem/ledakemlt12/leaktime/sort.c
View File

@ -5,6 +5,17 @@
Source: https://sorting.cr.yp.to Source: https://sorting.cr.yp.to
*/ */
#define int32_MINMAX(a,b) \
do { \
int32 ab = (b) ^ (a); \
int32 c = (b) - (a); \
c ^= ab & (c ^ (b)); \
c >>= 31; \
c &= ab; \
(a) ^= c; \
(b) ^= c; \
} while(0)
static void int32_sort(int32 *x, size_t n) { static void int32_sort(int32 *x, size_t n) {
size_t top, p, q, r, i, j; size_t top, p, q, r, i, j;

11
crypto_kem/ledakemlt12/leaktime/sort.h
View File

@ -6,17 +6,6 @@
#define int32 int32_t #define int32 int32_t
#define int32_MINMAX(a,b) \
do { \
int32 ab = (b) ^ (a); \
int32 c = (b) - (a); \
c ^= ab & (c ^ (b)); \
c >>= 31; \
c &= ab; \
(a) ^= c; \
(b) ^= c; \
} while(0)
void PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(uint32_t *x, size_t n); void PQCLEAN_LEDAKEMLT12_LEAKTIME_uint32_sort(uint32_t *x, size_t n);
#endif #endif

46
crypto_kem/ledakemlt32/leaktime/H_Q_matrices_generation.c
View File

@ -1,23 +1,19 @@
#include "H_Q_matrices_generation.h" #include "H_Q_matrices_generation.h"
#include "gf2x_arith_mod_xPplusOne.h" #include "gf2x_arith_mod_xPplusOne.h"
void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], AES_XOF_struct *keys_expander) {
AES_XOF_struct *keys_expander) { for (size_t i = 0; i < N0; i++) {
for (int i = 0; i < N0; i++) {
/* Generate a random block of Htr */ /* Generate a random block of Htr */
PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], DV, keys_expander);
DV,
keys_expander);
} }
} }
void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], AES_XOF_struct *keys_expander) {
AES_XOF_struct *keys_expander) { size_t placed_ones;
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
int placed_ones = 0; placed_ones = 0;
for (int j = 0; j < N0; j++) { for (size_t j = 0; j < N0; j++) {
PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones], PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones],
qBlockWeights[i][j], qBlockWeights[i][j],
keys_expander); keys_expander);
@ -26,29 +22,27 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M],
} }
} }
void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], /* output*/ void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], POSITION_T HPosOnes[N0][DV]) {
POSITION_T HPosOnes[N0][DV]) { for (size_t i = 0; i < N0; i++) {
for (int i = 0; i < N0; i++) {
/* Obtain directly the sparse representation of the block of H */ /* Obtain directly the sparse representation of the block of H */
for (int k = 0; k < DV; k++) { for (size_t k = 0; k < DV; k++) {
HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */ HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */
}// end for k }
} }
} }
void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], /* output*/ void PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], POSITION_T QPosOnes[N0][M]) {
POSITION_T QPosOnes[N0][M]) { POSITION_T transposed_ones_idx[N0] = {0x00};
size_t currQoneIdx, endQblockIdx;
unsigned transposed_ones_idx[N0] = {0x00}; for (size_t source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) {
for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { currQoneIdx = 0; // position in the column of QtrPosOnes[][...]
int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] endQblockIdx = 0;
int endQblockIdx = 0;
for (int blockIdx = 0; blockIdx < N0; blockIdx++) { for (int blockIdx = 0; blockIdx < N0; blockIdx++) {
endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; endQblockIdx += qBlockWeights[source_row_idx][blockIdx];
for (; currQoneIdx < endQblockIdx; currQoneIdx++) { for (; currQoneIdx < endQblockIdx; currQoneIdx++) {
QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P - QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] =
QPosOnes[source_row_idx][currQoneIdx]) % P; (P - QPosOnes[source_row_idx][currQoneIdx]) % P;
transposed_ones_idx[blockIdx]++; transposed_ones_idx[blockIdx]++;
} }
} }

45
crypto_kem/ledakemlt32/leaktime/bf_decoding.c
View File

@ -7,22 +7,26 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(DIGIT err[],
const POSITION_T HtrPosOnes[N0][DV], const POSITION_T HtrPosOnes[N0][DV],
const POSITION_T QtrPosOnes[N0][M], const POSITION_T QtrPosOnes[N0][M],
DIGIT privateSyndrome[], DIGIT privateSyndrome[],
uint8_t threshold) { uint8_t secondIterThreshold) {
DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT];
uint8_t unsatParityChecks[N0 * P]; uint8_t unsatParityChecks[N0 * P];
POSITION_T currQBlkPos[M], currQBitPos[M]; POSITION_T currQBlkPos[M], currQBitPos[M];
DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; POSITION_T syndromePosToFlip, tmp;
unsigned int correlation, corrt_syndrome_based;
size_t currQoneIdx, endQblockIdx, currblockoffset;
int check; int check;
int iteration = 0; int iteration = 0;
unsigned int corrt_syndrome_based;
do { do {
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome);
memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t));
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
for (int valueIdx = 0; valueIdx < P; valueIdx++) { for (size_t valueIdx = 0; valueIdx < P; valueIdx++) {
for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx); tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ?
(HtrPosOnes[i][HtrOneIdx] + valueIdx) - P :
(HtrPosOnes[i][HtrOneIdx] + valueIdx);
if (PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { if (PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) {
unsatParityChecks[i * P + valueIdx]++; unsatParityChecks[i * P + valueIdx]++;
} }
@ -31,33 +35,32 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(DIGIT err[],
} }
/* iteration based threshold determination*/ /* iteration based threshold determination*/
corrt_syndrome_based = iteration ? (unsigned int) threshold : B0; corrt_syndrome_based = iteration * secondIterThreshold + (1 - iteration) * B0;
//Computation of correlation with a full Q matrix // Computation of correlation with a full Q matrix
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
for (int j = 0; j < P; j++) { for (size_t j = 0; j < P; j++) {
int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] currQoneIdx = endQblockIdx = 0;
int endQblockIdx = 0; correlation = 0;
unsigned int correlation = 0;
for (int blockIdx = 0; blockIdx < N0; blockIdx++) { for (size_t blockIdx = 0; blockIdx < N0; blockIdx++) {
endQblockIdx += qBlockWeights[blockIdx][i]; endQblockIdx += qBlockWeights[blockIdx][i];
int currblockoffset = blockIdx * P; currblockoffset = blockIdx * P;
for (; currQoneIdx < endQblockIdx; currQoneIdx++) { for (; currQoneIdx < endQblockIdx; currQoneIdx++) {
POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j; tmp = QtrPosOnes[i][currQoneIdx] + j;
tmp = tmp >= P ? tmp - P : tmp; tmp = tmp >= P ? tmp - P : tmp;
currQBitPos[currQoneIdx] = tmp; currQBitPos[currQoneIdx] = tmp;
currQBlkPos[currQoneIdx] = blockIdx; currQBlkPos[currQoneIdx] = blockIdx;
correlation += unsatParityChecks[tmp + currblockoffset]; correlation += unsatParityChecks[tmp + currblockoffset];
} }
} }
/* Correlation based flipping */ /* Correlation based flipping */
if (correlation >= corrt_syndrome_based) { if (correlation >= corrt_syndrome_based) {
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j);
for (int v = 0; v < M; v++) { for (size_t v = 0; v < M; v++) {
POSITION_T syndromePosToFlip; for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v]);
syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] );
syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip;
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip);
} }

36
crypto_kem/ledakemlt32/leaktime/dfr_test.c
View File

@ -14,47 +14,49 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_
unsigned int maxMut[N0], maxMutMinusOne[N0]; unsigned int maxMut[N0], maxMutMinusOne[N0];
unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne;
unsigned int gammaHist[N0][DV * M + 1] = {{0}}; unsigned int gammaHist[N0][DV * M + 1] = {{0}};
unsigned int toAdd;
size_t histIdx;
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
for (int j = 0; j < DV * M; j++) { for (size_t j = 0; j < DV * M; j++) {
if (LSparse[i][j] != 0) { if (LSparse[i][j] != 0) {
LSparse_loc[i][j] = (P - LSparse[i][j]) ; LSparse_loc[i][j] = (P - LSparse[i][j]);
} }
} }
PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M); PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M);
} }
for (int i = 0; i < N0; i++ ) { for (size_t i = 0; i < N0; i++ ) {
for (int j = 0; j < N0; j++ ) { for (size_t j = 0; j < N0; j++) {
for (int k = 0; k < (DV * M); k++) { for (size_t k = 0; k < (DV * M); k++) {
for (int l = 0; l < (DV * M); l++) { for (size_t l = 0; l < (DV * M); l++) {
gamma[i][j][ (P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P ]++; gamma[i][j][(P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P]++;
} }
} }
} }
} }
for (int i = 0; i < N0; i++ ) { for (size_t i = 0; i < N0; i++ ) {
for (int j = 0; j < N0; j++ ) { for (size_t j = 0; j < N0; j++ ) {
gamma[i][j][0] = 0; gamma[i][j][0] = 0;
} }
} }
/* build histogram of values in gamma */ /* build histogram of values in gamma */
for (int i = 0; i < N0; i++ ) { for (size_t i = 0; i < N0; i++ ) {
for (int j = 0; j < N0; j++ ) { for (size_t j = 0; j < N0; j++ ) {
for (int k = 0; k < P; k++) { for (size_t k = 0; k < P; k++) {
gammaHist[i][gamma[i][j][k]]++; gammaHist[i][gamma[i][j][k]]++;
} }
} }
} }
for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) {
unsigned int toAdd = T_BAR - 1;
maxMutMinusOne[gammaBlockRowIdx] = 0; maxMutMinusOne[gammaBlockRowIdx] = 0;
unsigned int histIdx = DV * M; histIdx = DV * M;
toAdd = T_BAR - 1;
while ( (histIdx > 0) && (toAdd > 0)) { while ( (histIdx > 0) && (toAdd > 0)) {
if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) {
maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd;
@ -71,7 +73,7 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_
/*seek max values across all gamma blocks */ /*seek max values across all gamma blocks */
allBlockMaxSumst = maxMut[0]; allBlockMaxSumst = maxMut[0];
allBlockMaxSumstMinusOne = maxMutMinusOne[0]; allBlockMaxSumstMinusOne = maxMutMinusOne[0];
for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) {
allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ?
maxMut[gammaBlockRowIdx] : maxMut[gammaBlockRowIdx] :
allBlockMaxSumst; allBlockMaxSumst;

2
crypto_kem/ledakemlt32/leaktime/gf2x_arith.c
View File

@ -52,7 +52,7 @@ static void gf2x_mul1(DIGIT *R, const DIGIT A, const DIGIT B) {
R[0] = 0; R[0] = 0;
R[1] = (A & 1) * B; R[1] = (A & 1) * B;
for (unsigned i = 1; i < DIGIT_SIZE_b; i++) { for (uint8_t i = 1; i < DIGIT_SIZE_b; i++) {
tmp = ((A >> i) & 1) * B; tmp = ((A >> i) & 1) * B;
R[1] ^= tmp << i; R[1] ^= tmp << i;
R[0] ^= tmp >> (DIGIT_SIZE_b - i); R[0] ^= tmp >> (DIGIT_SIZE_b - i);

112
crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.c
View File

@ -5,39 +5,39 @@
#include <string.h> // memcpy(...), memset(...) #include <string.h> // memcpy(...), memset(...)
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) {
for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
dest[i] = in[i]; dest[i] = in[i];
} }
} }
/* returns the coefficient of the x^exponent term as the LSB of a digit */ /* returns the coefficient of the x^exponent term as the LSB of a digit */
DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) { DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent) {
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; size_t digitIdx = straightIdx / DIGIT_SIZE_b;
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ;
} }
/* sets the coefficient of the x^exponent term as the LSB of a digit */ /* sets the coefficient of the x^exponent term as the LSB of a digit */
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) { void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value) {
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; size_t digitIdx = straightIdx / DIGIT_SIZE_b;
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
/* clear given coefficient */ /* clear given coefficient */
DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); DIGIT mask = ~(((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
poly[digitIdx] = poly[digitIdx] & mask; poly[digitIdx] = poly[digitIdx] & mask;
poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); poly[digitIdx] = poly[digitIdx] | ((value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx));
} }
/* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ /* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) { void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent) {
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; size_t digitIdx = straightIdx / DIGIT_SIZE_b;
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
/* clear given coefficient */ /* clear given coefficient */
DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); DIGIT mask = (((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
poly[digitIdx] = poly[digitIdx] ^ mask; poly[digitIdx] = poly[digitIdx] ^ mask;
} }
@ -51,7 +51,7 @@ static int popcount_uint64t(uint64_t x) {
} }
/* population count for a single polynomial */ /* population count for a single polynomial */
int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(DIGIT *poly) { int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(const DIGIT *poly) {
int ret = 0; int ret = 0;
for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) {
ret += popcount_uint64t(poly[i]); ret += popcount_uint64t(poly[i]);
@ -74,10 +74,9 @@ static void gf2x_mod(DIGIT out[], const DIGIT in[]) {
out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1; out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1;
} }
static void right_bit_shift(unsigned int length, DIGIT in[]) { static void right_bit_shift(size_t length, DIGIT in[]) {
size_t j;
unsigned int j; for (j = length - 1; j > 0; j--) {
for (j = length - 1; j > 0 ; j--) {
in[j] >>= 1; in[j] >>= 1;
in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1);
} }
@ -86,8 +85,8 @@ static void right_bit_shift(unsigned int length, DIGIT in[]) {
/* shifts by whole digits */ /* shifts by whole digits */
static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) { static void left_DIGIT_shift_n(size_t length, DIGIT in[], size_t amount) {
unsigned int j; size_t j;
for (j = 0; (j + amount) < length; j++) { for (j = 0; (j + amount) < length; j++) {
in[j] = in[j + amount]; in[j] = in[j + amount];
} }
@ -97,7 +96,7 @@ static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amo
} }
/* may shift by an arbitrary amount*/ /* may shift by an arbitrary amount*/
static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) { static void left_bit_shift_wide_n(size_t length, DIGIT in[], size_t amount) {
left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b);
PQCLEAN_LEDAKEMLT32_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); PQCLEAN_LEDAKEMLT32_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b);
} }
@ -123,18 +122,22 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) {
DIGIT mask = (DIGIT)0x1; DIGIT mask = (DIGIT)0x1;
DIGIT rev1, rev2, a00; DIGIT rev1, rev2, a00;
int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; int slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P;
a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask;
right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A);
for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { for (size_t i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) {
rev1 = reverse_digit(A[i]); rev1 = reverse_digit(A[i]);
rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]);
A[i] = rev2; A[i] = rev2;
A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1;
} }
if (NUM_DIGITS_GF2X_ELEMENT % 2 == 1) {
A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]);
}
if (slack_bits_amount) { if (slack_bits_amount) {
PQCLEAN_LEDAKEMLT32_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); PQCLEAN_LEDAKEMLT32_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount);
} }
@ -151,10 +154,9 @@ static void rotate_bit_right(DIGIT in[]) { /* x^{-1} * in(x) mod x^P+1 */
} }
/* cond swap: swaps digits A and B if swap_mask == -1 */ /* cond swap: swaps digits A and B if swap_mask == -1 */
static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { static void gf2x_cswap(DIGIT *a, DIGIT *b, int32_t swap_mask) {
int i;
DIGIT t; DIGIT t;
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
t = swap_mask & (a[i] ^ b[i]); t = swap_mask & (a[i] ^ b[i]);
a[i] ^= t; a[i] ^= t;
b[i] ^= t; b[i] ^= t;
@ -162,18 +164,18 @@ static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) {
} }
/* returns -1 mask if x != 0, otherwise 0 */ /* returns -1 mask if x != 0, otherwise 0 */
static inline int nonzero(DIGIT x) { static inline int32_t nonzero(DIGIT x) {
DIGIT t = x; DIGIT t = x;
t = (~t) + 1; t = (~t) + 1;
t >>= DIGIT_SIZE_b - 1; t >>= DIGIT_SIZE_b - 1;
return -((int)t); return -((int32_t)t);
} }
/* returns -1 mask if x < 0 else 0 */ /* returns -1 mask if x < 0 else 0 */
static inline int negative(int x) { static inline int32_t negative(int x) {
uint32_t u = x; uint32_t u = x;
u >>= 31; u >>= 31;
return -((int)u); return -((int32_t)u);
} }
/* return f(0) as digit */ /* return f(0) as digit */
@ -191,7 +193,7 @@ static void gf2x_mult_scalar_acc(DIGIT *f, const DIGIT *g, const DIGIT s) {
/* constant-time inverse, source: gcd.cr.yp.to */ /* constant-time inverse, source: gcd.cr.yp.to */
int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) {
int i, loop, swap, delta = 1; int32_t swap, delta = 1;
DIGIT g0_mask; DIGIT g0_mask;
DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1 DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1
@ -202,17 +204,17 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[])
f[NUM_DIGITS_GF2X_MODULUS - 1] = 1; f[NUM_DIGITS_GF2X_MODULUS - 1] = 1;
f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS);
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
g[i] = in[i]; g[i] = in[i];
} }
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
v[i] = 0; v[i] = 0;
} }
r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1; r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1;
for (loop = 0; loop < 2 * P - 1; ++loop) { for (int loop = 0; loop < 2 * P - 1; ++loop) {
swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0 swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0
delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap
@ -247,7 +249,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], con
/*PRE: the representation of the sparse coefficients is sorted in increasing /*PRE: the representation of the sparse coefficients is sorted in increasing
order of the coefficients themselves */ order of the coefficients themselves */
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[],
POSITION_T sparse[], unsigned int nPos) { POSITION_T sparse[], size_t nPos) {
DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00};
DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00};
@ -258,7 +260,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]);
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]);
for (unsigned int i = 1; i < nPos; i++) { for (size_t i = 1; i < nPos; i++) {
if (sparse[i] != INVALID_POS_VALUE) { if (sparse[i] != INVALID_POS_VALUE) {
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) );
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT);
@ -270,10 +272,9 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons
} }
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) { void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]) {
POSITION_T t; POSITION_T t;
int i = 0, j; size_t i = 0, j;
if (A[i] == 0) { if (A[i] == 0) {
i = 1; i = 1;
@ -297,6 +298,9 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
size_t sizeB, const POSITION_T B[]) { size_t sizeB, const POSITION_T B[]) {
POSITION_T prod; POSITION_T prod;
POSITION_T lastReadPos;
size_t duplicateCount;
size_t write_idx, read_idx;
/* compute all the coefficients, filling invalid positions with P*/ /* compute all the coefficients, filling invalid positions with P*/
size_t lastFilledPos = 0; size_t lastFilledPos = 0;
@ -317,12 +321,11 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
Res[lastFilledPos] = INVALID_POS_VALUE; Res[lastFilledPos] = INVALID_POS_VALUE;
lastFilledPos++; lastFilledPos++;
} }
PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(Res, sizeR); PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(Res, sizeR);
/* eliminate duplicates */ /* eliminate duplicates */
POSITION_T lastReadPos = Res[0]; write_idx = read_idx = 0;
size_t duplicateCount;
size_t write_idx = 0;
size_t read_idx = 0;
while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) {
lastReadPos = Res[read_idx]; lastReadPos = Res[read_idx];
read_idx++; read_idx++;
@ -344,13 +347,12 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
/* the implementation is safe even in case A or B alias with the result /* the implementation is safe even in case A or B alias with the result
* PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse( void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[],
int sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[],
int sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]) {
int sizeB, const POSITION_T B[]) {
POSITION_T tmpRes[DV * M]; POSITION_T tmpRes[DV * M];
int idxA = 0, idxB = 0, idxR = 0; size_t idxA = 0, idxB = 0, idxR = 0;
while ( idxA < sizeA && while ( idxA < sizeA &&
idxB < sizeB && idxB < sizeB &&
A[idxA] != INVALID_POS_VALUE && A[idxA] != INVALID_POS_VALUE &&
@ -419,18 +421,18 @@ static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct
/* Obtains fresh randomness and seed-expands it until all the required positions /* Obtains fresh randomness and seed-expands it until all the required positions
* for the '1's in the circulant block are obtained */ * for the '1's in the circulant block are obtained */
void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones,
int countOnes, size_t countOnes,
AES_XOF_struct *seed_expander_ctx) { AES_XOF_struct *seed_expander_ctx) {
int duplicated, placedOnes = 0; size_t duplicated, placedOnes = 0;
uint32_t p; POSITION_T p;
while (placedOnes < countOnes) { while (placedOnes < countOnes) {
p = rand_range(NUM_BITS_GF2X_ELEMENT, p = rand_range(NUM_BITS_GF2X_ELEMENT,
P_BITS, P_BITS,
seed_expander_ctx); seed_expander_ctx);
duplicated = 0; duplicated = 0;
for (int j = 0; j < placedOnes; j++) { for (size_t j = 0; j < placedOnes; j++) {
if (pos_ones[j] == p) { if (pos_ones[j] == p) {
duplicated = 1; duplicated = 1;
} }

16
crypto_kem/ledakemlt32/leaktime/gf2x_arith_mod_xPplusOne.h
View File

@ -16,22 +16,22 @@
#define P_BITS (17) #define P_BITS (17)
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]);
DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent); DIGIT PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent);
int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(DIGIT *poly); int PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(const DIGIT *poly);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, size_t countOnes, AES_XOF_struct *seed_expander_ctx);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT32_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]); void PQCLEAN_LEDAKEMLT32_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]);
int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); int PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], size_t nPos);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly);
void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); void PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes);

11
crypto_kem/ledakemlt32/leaktime/kem.c
View File

@ -107,10 +107,11 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH]; uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH];
uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0}; uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0};
uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0}; uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0};
int decode_ok, decrypt_ok, equal;
unpack_ct(syndrome, ct); unpack_ct(syndrome, ct);
int decode_ok = PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(decoded_error_vector, decode_ok = PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(decoded_error_vector,
(const privateKeyNiederreiter_t *)sk, syndrome); (const privateKeyNiederreiter_t *)sk, syndrome);
pack_error(decoded_error_bytes, decoded_error_vector); pack_error(decoded_error_bytes, decoded_error_vector);
@ -118,7 +119,7 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH); memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH);
for (int i = 0; i < TRNG_BYTE_LENGTH; ++i) { for (size_t i = 0; i < TRNG_BYTE_LENGTH; ++i) {
decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^ decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^
hashedAndTruncatedErrorVector[i]; hashedAndTruncatedErrorVector[i];
} }
@ -135,11 +136,11 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
PQCLEAN_LEDAKEMLT32_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos); PQCLEAN_LEDAKEMLT32_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos);
int equal = PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_verify(decoded_error_vector, equal = PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_verify(decoded_error_vector,
reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT);
// equal == 0, if the reconstructed error vector match !!! // equal == 0, if the reconstructed error vector match !!!
int decryptOk = (decode_ok == 1 && equal == 0); decrypt_ok = (decode_ok == 1 && equal == 0);
memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH); memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH);
memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH); memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH);
@ -148,7 +149,7 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
PQCLEAN_LEDAKEMLT32_LEAKTIME_cmov(ss_input + sizeof(decoded_seed), PQCLEAN_LEDAKEMLT32_LEAKTIME_cmov(ss_input + sizeof(decoded_seed),
((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret, ((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret,
TRNG_BYTE_LENGTH, TRNG_BYTE_LENGTH,
!decryptOk); !decrypt_ok);
HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH); HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH);

44
crypto_kem/ledakemlt32/leaktime/niederreiter.c
View File

@ -49,7 +49,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p
} }
} }
is_L_full = 1; is_L_full = 1;
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE);
} }
sk->rejections = sk->rejections + 1; sk->rejections = sk->rejections + 1;
@ -63,21 +63,21 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p
sk->decryption_failure_secret, sk->decryption_failure_secret,
(unsigned long)TRNG_BYTE_LENGTH); (unsigned long)TRNG_BYTE_LENGTH);
for (int j = 0; j < DV * M; j++) { for (size_t j = 0; j < DV * M; j++) {
if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) {
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1);
} }
} }
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense);
for (int i = 0; i < N0 - 1; i++) { for (size_t i = 0; i < N0 - 1; i++) {
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT,
Ln0Inv, Ln0Inv,
LPosOnes[i], LPosOnes[i],
DV * M); DV * M);
} }
for (int i = 0; i < N0 - 1; i++) { for (size_t i = 0; i < N0 - 1; i++) {
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT);
} }
} }
@ -110,24 +110,27 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
POSITION_T auxSparse[DV * M]; POSITION_T auxSparse[DV * M];
POSITION_T Ln0trSparse[DV * M]; POSITION_T Ln0trSparse[DV * M];
DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0}; DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0};
DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B];
DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT];
unsigned char processedQOnes[N0]; uint8_t processedQOnes[N0];
int rejections = sk->rejections; int rejections = sk->rejections;
int decrypt_ok = 0;
int err_weight;
PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed);
do { do {
PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander); PQCLEAN_LEDAKEMLT32_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander);
PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander); PQCLEAN_LEDAKEMLT32_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander);
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
for (int j = 0; j < DV * M; j++) { for (size_t j = 0; j < DV * M; j++) {
LPosOnes[i][j] = INVALID_POS_VALUE; LPosOnes[i][j] = INVALID_POS_VALUE;
} }
} }
memset(processedQOnes, 0x00, sizeof(processedQOnes)); memset(processedQOnes, 0x00, sizeof(processedQOnes));
for (int colQ = 0; colQ < N0; colQ++) { for (size_t colQ = 0; colQ < N0; colQ++) {
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes,
DV, HPosOnes[i], DV, HPosOnes[i],
qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]);
@ -143,15 +146,15 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes); PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes);
PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes); PQCLEAN_LEDAKEMLT32_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes);
for (int i = 0; i < DV * M; i++) { for (size_t i = 0; i < DV * M; i++) {
Ln0trSparse[i] = INVALID_POS_VALUE; Ln0trSparse[i] = INVALID_POS_VALUE;
auxSparse[i] = INVALID_POS_VALUE; auxSparse[i] = INVALID_POS_VALUE;
} }
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse,
DV, HPosOnes[i], DV, HPosOnes[i],
qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1] ] ); qBlockWeights[i][N0 - 1], &QPosOnes[i][M - qBlockWeights[i][N0 - 1]]);
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse,
DV * M, Ln0trSparse, DV * M, Ln0trSparse,
DV * M, auxSparse); DV * M, auxSparse);
@ -163,28 +166,27 @@ int PQCLEAN_LEDAKEMLT32_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
Ln0trSparse, Ln0trSparse,
DV * M); DV * M);
int decryptOk = 0; decrypt_ok = PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(err_computed,
decryptOk = PQCLEAN_LEDAKEMLT32_LEAKTIME_bf_decoding(err_computed,
(const POSITION_T (*)[DV]) HtrPosOnes, (const POSITION_T (*)[DV]) HtrPosOnes,
(const POSITION_T (*)[M]) QtrPosOnes, (const POSITION_T (*)[M]) QtrPosOnes,
privateSyndrome, sk->secondIterThreshold); privateSyndrome, sk->secondIterThreshold);
int err_weight = 0; err_weight = 0;
for (int i = 0 ; i < N0; i++) { for (size_t i = 0 ; i < N0; i++) {
err_weight += PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i)); err_weight += PQCLEAN_LEDAKEMLT32_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i));
} }
decryptOk = decryptOk && (err_weight == NUM_ERRORS_T); decrypt_ok = decrypt_ok && (err_weight == NUM_ERRORS_T);
/* prepare mockup error vector in case a decoding failure occurs */ /* prepare mockup error vector in case a decoding failure occurs */
DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B];
memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH); memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH);
memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00, memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00,
(N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH); (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH);
memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
// Overwrite on decryption failure
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decryptOk);
return decryptOk; // Overwrite on decryption failure
PQCLEAN_LEDAKEMLT32_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decrypt_ok);
return decrypt_ok;
} }

12
crypto_kem/ledakemlt32/leaktime/rng.c
View File

@ -13,8 +13,8 @@
maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier
*/ */
static void seedexpander_init(AES_XOF_struct *ctx, static void seedexpander_init(AES_XOF_struct *ctx,
unsigned char *seed, uint8_t *seed,
unsigned char *diversifier, uint8_t *diversifier,
size_t maxlen) { size_t maxlen) {
ctx->length_remaining = maxlen; ctx->length_remaining = maxlen;
@ -38,13 +38,13 @@ static void seedexpander_init(AES_XOF_struct *ctx,
} }
void PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, void PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx,
const unsigned char *trng_entropy const uint8_t *trng_entropy
/* TRNG_BYTE_LENGTH wide buffer */) { /* TRNG_BYTE_LENGTH wide buffer */) {
/*the NIST seedexpander will however access 32B from this buffer */ /*the NIST seedexpander will however access 32B from this buffer */
unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH;
unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 }; uint8_t prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = {0x00};
unsigned char diversifier[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; uint8_t diversifier[8] = {0};
memcpy(prng_buffer, memcpy(prng_buffer,
trng_entropy, trng_entropy,
@ -61,7 +61,7 @@ void PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx,
x - returns the XOF data x - returns the XOF data
xlen - number of bytes to return xlen - number of bytes to return
*/ */
int PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) { int PQCLEAN_LEDAKEMLT32_LEAKTIME_seedexpander(AES_XOF_struct *ctx, uint8_t *x, size_t xlen) {
size_t offset; size_t offset;
aes256ctx ctx256; aes256ctx ctx256;

11
crypto_kem/ledakemlt32/leaktime/sort.c
View File

@ -5,6 +5,17 @@
Source: https://sorting.cr.yp.to Source: https://sorting.cr.yp.to
*/ */
#define int32_MINMAX(a,b) \
do { \
int32 ab = (b) ^ (a); \
int32 c = (b) - (a); \
c ^= ab & (c ^ (b)); \
c >>= 31; \
c &= ab; \
(a) ^= c; \
(b) ^= c; \
} while(0)
static void int32_sort(int32 *x, size_t n) { static void int32_sort(int32 *x, size_t n) {
size_t top, p, q, r, i, j; size_t top, p, q, r, i, j;

11
crypto_kem/ledakemlt32/leaktime/sort.h
View File

@ -6,17 +6,6 @@
#define int32 int32_t #define int32 int32_t
#define int32_MINMAX(a,b) \
do { \
int32 ab = (b) ^ (a); \
int32 c = (b) - (a); \
c ^= ab & (c ^ (b)); \
c >>= 31; \
c &= ab; \
(a) ^= c; \
(b) ^= c; \
} while(0)
void PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(uint32_t *x, size_t n); void PQCLEAN_LEDAKEMLT32_LEAKTIME_uint32_sort(uint32_t *x, size_t n);
#endif #endif

46
crypto_kem/ledakemlt52/leaktime/H_Q_matrices_generation.c
View File

@ -1,23 +1,19 @@
#include "H_Q_matrices_generation.h" #include "H_Q_matrices_generation.h"
#include "gf2x_arith_mod_xPplusOne.h" #include "gf2x_arith_mod_xPplusOne.h"
void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(POSITION_T HPosOnes[N0][DV], AES_XOF_struct *keys_expander) {
AES_XOF_struct *keys_expander) { for (size_t i = 0; i < N0; i++) {
for (int i = 0; i < N0; i++) {
/* Generate a random block of Htr */ /* Generate a random block of Htr */
PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&HPosOnes[i][0], DV, keys_expander);
DV,
keys_expander);
} }
} }
void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M], AES_XOF_struct *keys_expander) {
AES_XOF_struct *keys_expander) { size_t placed_ones;
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
int placed_ones = 0; placed_ones = 0;
for (int j = 0; j < N0; j++) { for (size_t j = 0; j < N0; j++) {
PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones], PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(&QPosOnes[i][placed_ones],
qBlockWeights[i][j], qBlockWeights[i][j],
keys_expander); keys_expander);
@ -26,29 +22,27 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(POSITION_T QPosOnes[N0][M],
} }
} }
void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], /* output*/ void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(POSITION_T HtrPosOnes[N0][DV], POSITION_T HPosOnes[N0][DV]) {
POSITION_T HPosOnes[N0][DV]) { for (size_t i = 0; i < N0; i++) {
for (int i = 0; i < N0; i++) {
/* Obtain directly the sparse representation of the block of H */ /* Obtain directly the sparse representation of the block of H */
for (int k = 0; k < DV; k++) { for (size_t k = 0; k < DV; k++) {
HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */ HtrPosOnes[i][k] = (P - HPosOnes[i][k]) % P; /* transposes indexes */
}// end for k }
} }
} }
void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], /* output*/ void PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(POSITION_T QtrPosOnes[N0][M], POSITION_T QPosOnes[N0][M]) {
POSITION_T QPosOnes[N0][M]) { POSITION_T transposed_ones_idx[N0] = {0x00};
size_t currQoneIdx, endQblockIdx;
unsigned transposed_ones_idx[N0] = {0x00}; for (size_t source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) {
for (unsigned source_row_idx = 0; source_row_idx < N0 ; source_row_idx++) { currQoneIdx = 0; // position in the column of QtrPosOnes[][...]
int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] endQblockIdx = 0;
int endQblockIdx = 0;
for (int blockIdx = 0; blockIdx < N0; blockIdx++) { for (int blockIdx = 0; blockIdx < N0; blockIdx++) {
endQblockIdx += qBlockWeights[source_row_idx][blockIdx]; endQblockIdx += qBlockWeights[source_row_idx][blockIdx];
for (; currQoneIdx < endQblockIdx; currQoneIdx++) { for (; currQoneIdx < endQblockIdx; currQoneIdx++) {
QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] = (P - QtrPosOnes[blockIdx][transposed_ones_idx[blockIdx]] =
QPosOnes[source_row_idx][currQoneIdx]) % P; (P - QPosOnes[source_row_idx][currQoneIdx]) % P;
transposed_ones_idx[blockIdx]++; transposed_ones_idx[blockIdx]++;
} }
} }

45
crypto_kem/ledakemlt52/leaktime/bf_decoding.c
View File

@ -7,22 +7,26 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(DIGIT err[],
const POSITION_T HtrPosOnes[N0][DV], const POSITION_T HtrPosOnes[N0][DV],
const POSITION_T QtrPosOnes[N0][M], const POSITION_T QtrPosOnes[N0][M],
DIGIT privateSyndrome[], DIGIT privateSyndrome[],
uint8_t threshold) { uint8_t secondIterThreshold) {
DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT];
uint8_t unsatParityChecks[N0 * P]; uint8_t unsatParityChecks[N0 * P];
POSITION_T currQBlkPos[M], currQBitPos[M]; POSITION_T currQBlkPos[M], currQBitPos[M];
DIGIT currSyndrome[NUM_DIGITS_GF2X_ELEMENT]; POSITION_T syndromePosToFlip, tmp;
unsigned int correlation, corrt_syndrome_based;
size_t currQoneIdx, endQblockIdx, currblockoffset;
int check; int check;
int iteration = 0; int iteration = 0;
unsigned int corrt_syndrome_based;
do { do {
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome); PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(currSyndrome, privateSyndrome);
memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t)); memset(unsatParityChecks, 0x00, N0 * P * sizeof(uint8_t));
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
for (int valueIdx = 0; valueIdx < P; valueIdx++) { for (size_t valueIdx = 0; valueIdx < P; valueIdx++) {
for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
POSITION_T tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ? (HtrPosOnes[i][HtrOneIdx] + valueIdx) - P : (HtrPosOnes[i][HtrOneIdx] + valueIdx); tmp = (HtrPosOnes[i][HtrOneIdx] + valueIdx) >= P ?
(HtrPosOnes[i][HtrOneIdx] + valueIdx) - P :
(HtrPosOnes[i][HtrOneIdx] + valueIdx);
if (PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) { if (PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(currSyndrome, tmp)) {
unsatParityChecks[i * P + valueIdx]++; unsatParityChecks[i * P + valueIdx]++;
} }
@ -31,33 +35,32 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(DIGIT err[],
} }
/* iteration based threshold determination*/ /* iteration based threshold determination*/
corrt_syndrome_based = iteration ? (unsigned int) threshold : B0; corrt_syndrome_based = iteration * secondIterThreshold + (1 - iteration) * B0;
//Computation of correlation with a full Q matrix // Computation of correlation with a full Q matrix
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
for (int j = 0; j < P; j++) { for (size_t j = 0; j < P; j++) {
int currQoneIdx = 0; // position in the column of QtrPosOnes[][...] currQoneIdx = endQblockIdx = 0;
int endQblockIdx = 0; correlation = 0;
unsigned int correlation = 0;
for (int blockIdx = 0; blockIdx < N0; blockIdx++) { for (size_t blockIdx = 0; blockIdx < N0; blockIdx++) {
endQblockIdx += qBlockWeights[blockIdx][i]; endQblockIdx += qBlockWeights[blockIdx][i];
int currblockoffset = blockIdx * P; currblockoffset = blockIdx * P;
for (; currQoneIdx < endQblockIdx; currQoneIdx++) { for (; currQoneIdx < endQblockIdx; currQoneIdx++) {
POSITION_T tmp = QtrPosOnes[i][currQoneIdx] + j; tmp = QtrPosOnes[i][currQoneIdx] + j;
tmp = tmp >= P ? tmp - P : tmp; tmp = tmp >= P ? tmp - P : tmp;
currQBitPos[currQoneIdx] = tmp; currQBitPos[currQoneIdx] = tmp;
currQBlkPos[currQoneIdx] = blockIdx; currQBlkPos[currQoneIdx] = blockIdx;
correlation += unsatParityChecks[tmp + currblockoffset]; correlation += unsatParityChecks[tmp + currblockoffset];
} }
} }
/* Correlation based flipping */ /* Correlation based flipping */
if (correlation >= corrt_syndrome_based) { if (correlation >= corrt_syndrome_based) {
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j); PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(err + NUM_DIGITS_GF2X_ELEMENT * i, j);
for (int v = 0; v < M; v++) { for (size_t v = 0; v < M; v++) {
POSITION_T syndromePosToFlip; for (size_t HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) {
for (int HtrOneIdx = 0; HtrOneIdx < DV; HtrOneIdx++) { syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v]);
syndromePosToFlip = (HtrPosOnes[currQBlkPos[v]][HtrOneIdx] + currQBitPos[v] );
syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip; syndromePosToFlip = syndromePosToFlip >= P ? syndromePosToFlip - P : syndromePosToFlip;
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip); PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(privateSyndrome, syndromePosToFlip);
} }

36
crypto_kem/ledakemlt52/leaktime/dfr_test.c
View File

@ -14,47 +14,49 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_
unsigned int maxMut[N0], maxMutMinusOne[N0]; unsigned int maxMut[N0], maxMutMinusOne[N0];
unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne; unsigned int allBlockMaxSumst, allBlockMaxSumstMinusOne;
unsigned int gammaHist[N0][DV * M + 1] = {{0}}; unsigned int gammaHist[N0][DV * M + 1] = {{0}};
unsigned int toAdd;
size_t histIdx;
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
for (int j = 0; j < DV * M; j++) { for (size_t j = 0; j < DV * M; j++) {
if (LSparse[i][j] != 0) { if (LSparse[i][j] != 0) {
LSparse_loc[i][j] = (P - LSparse[i][j]) ; LSparse_loc[i][j] = (P - LSparse[i][j]);
} }
} }
PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M); PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(LSparse_loc[i], DV * M);
} }
for (int i = 0; i < N0; i++ ) { for (size_t i = 0; i < N0; i++ ) {
for (int j = 0; j < N0; j++ ) { for (size_t j = 0; j < N0; j++) {
for (int k = 0; k < (DV * M); k++) { for (size_t k = 0; k < (DV * M); k++) {
for (int l = 0; l < (DV * M); l++) { for (size_t l = 0; l < (DV * M); l++) {
gamma[i][j][ (P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P ]++; gamma[i][j][(P + LSparse_loc[i][k] - LSparse_loc[j][l]) % P]++;
} }
} }
} }
} }
for (int i = 0; i < N0; i++ ) { for (size_t i = 0; i < N0; i++ ) {
for (int j = 0; j < N0; j++ ) { for (size_t j = 0; j < N0; j++ ) {
gamma[i][j][0] = 0; gamma[i][j][0] = 0;
} }
} }
/* build histogram of values in gamma */ /* build histogram of values in gamma */
for (int i = 0; i < N0; i++ ) { for (size_t i = 0; i < N0; i++ ) {
for (int j = 0; j < N0; j++ ) { for (size_t j = 0; j < N0; j++ ) {
for (int k = 0; k < P; k++) { for (size_t k = 0; k < P; k++) {
gammaHist[i][gamma[i][j][k]]++; gammaHist[i][gamma[i][j][k]]++;
} }
} }
} }
for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) { for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0; gammaBlockRowIdx++) {
unsigned int toAdd = T_BAR - 1;
maxMutMinusOne[gammaBlockRowIdx] = 0; maxMutMinusOne[gammaBlockRowIdx] = 0;
unsigned int histIdx = DV * M; histIdx = DV * M;
toAdd = T_BAR - 1;
while ( (histIdx > 0) && (toAdd > 0)) { while ( (histIdx > 0) && (toAdd > 0)) {
if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) { if (gammaHist[gammaBlockRowIdx][histIdx] > toAdd ) {
maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd; maxMutMinusOne[gammaBlockRowIdx] += histIdx * toAdd;
@ -71,7 +73,7 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_DFR_test(POSITION_T LSparse[N0][DV * M], uint8_
/*seek max values across all gamma blocks */ /*seek max values across all gamma blocks */
allBlockMaxSumst = maxMut[0]; allBlockMaxSumst = maxMut[0];
allBlockMaxSumstMinusOne = maxMutMinusOne[0]; allBlockMaxSumstMinusOne = maxMutMinusOne[0];
for (int gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) { for (size_t gammaBlockRowIdx = 0; gammaBlockRowIdx < N0 ; gammaBlockRowIdx++) {
allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ? allBlockMaxSumst = allBlockMaxSumst < maxMut[gammaBlockRowIdx] ?
maxMut[gammaBlockRowIdx] : maxMut[gammaBlockRowIdx] :
allBlockMaxSumst; allBlockMaxSumst;

2
crypto_kem/ledakemlt52/leaktime/gf2x_arith.c
View File

@ -52,7 +52,7 @@ static void gf2x_mul1(DIGIT *R, const DIGIT A, const DIGIT B) {
R[0] = 0; R[0] = 0;
R[1] = (A & 1) * B; R[1] = (A & 1) * B;
for (unsigned i = 1; i < DIGIT_SIZE_b; i++) { for (uint8_t i = 1; i < DIGIT_SIZE_b; i++) {
tmp = ((A >> i) & 1) * B; tmp = ((A >> i) & 1) * B;
R[1] ^= tmp << i; R[1] ^= tmp << i;
R[0] ^= tmp >> (DIGIT_SIZE_b - i); R[0] ^= tmp >> (DIGIT_SIZE_b - i);

112
crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.c
View File

@ -5,39 +5,39 @@
#include <string.h> // memcpy(...), memset(...) #include <string.h> // memcpy(...), memset(...)
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) { void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]) {
for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
dest[i] = in[i]; dest[i] = in[i];
} }
} }
/* returns the coefficient of the x^exponent term as the LSB of a digit */ /* returns the coefficient of the x^exponent term as the LSB of a digit */
DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent) { DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent) {
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; size_t digitIdx = straightIdx / DIGIT_SIZE_b;
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ; return (poly[digitIdx] >> (DIGIT_SIZE_b - 1 - inDigitIdx)) & ((DIGIT) 1) ;
} }
/* sets the coefficient of the x^exponent term as the LSB of a digit */ /* sets the coefficient of the x^exponent term as the LSB of a digit */
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value) { void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value) {
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; size_t digitIdx = straightIdx / DIGIT_SIZE_b;
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
/* clear given coefficient */ /* clear given coefficient */
DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); DIGIT mask = ~(((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
poly[digitIdx] = poly[digitIdx] & mask; poly[digitIdx] = poly[digitIdx] & mask;
poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); poly[digitIdx] = poly[digitIdx] | ((value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx));
} }
/* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ /* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) { void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent) {
unsigned int straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent; size_t straightIdx = (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - 1) - exponent;
unsigned int digitIdx = straightIdx / DIGIT_SIZE_b; size_t digitIdx = straightIdx / DIGIT_SIZE_b;
unsigned int inDigitIdx = straightIdx % DIGIT_SIZE_b; size_t inDigitIdx = straightIdx % DIGIT_SIZE_b;
/* clear given coefficient */ /* clear given coefficient */
DIGIT mask = ( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); DIGIT mask = (((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx));
poly[digitIdx] = poly[digitIdx] ^ mask; poly[digitIdx] = poly[digitIdx] ^ mask;
} }
@ -51,7 +51,7 @@ static int popcount_uint64t(uint64_t x) {
} }
/* population count for a single polynomial */ /* population count for a single polynomial */
int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(DIGIT *poly) { int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(const DIGIT *poly) {
int ret = 0; int ret = 0;
for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) { for (int i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= 0; i--) {
ret += popcount_uint64t(poly[i]); ret += popcount_uint64t(poly[i]);
@ -74,10 +74,9 @@ static void gf2x_mod(DIGIT out[], const DIGIT in[]) {
out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1; out[0] &= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS) - 1;
} }
static void right_bit_shift(unsigned int length, DIGIT in[]) { static void right_bit_shift(size_t length, DIGIT in[]) {
size_t j;
unsigned int j; for (j = length - 1; j > 0; j--) {
for (j = length - 1; j > 0 ; j--) {
in[j] >>= 1; in[j] >>= 1;
in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1); in[j] |= (in[j - 1] & (DIGIT)0x01) << (DIGIT_SIZE_b - 1);
} }
@ -86,8 +85,8 @@ static void right_bit_shift(unsigned int length, DIGIT in[]) {
/* shifts by whole digits */ /* shifts by whole digits */
static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amount) { static void left_DIGIT_shift_n(size_t length, DIGIT in[], size_t amount) {
unsigned int j; size_t j;
for (j = 0; (j + amount) < length; j++) { for (j = 0; (j + amount) < length; j++) {
in[j] = in[j + amount]; in[j] = in[j + amount];
} }
@ -97,7 +96,7 @@ static void left_DIGIT_shift_n(unsigned int length, DIGIT in[], unsigned int amo
} }
/* may shift by an arbitrary amount*/ /* may shift by an arbitrary amount*/
static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amount) { static void left_bit_shift_wide_n(size_t length, DIGIT in[], size_t amount) {
left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b); left_DIGIT_shift_n(length, in, amount / DIGIT_SIZE_b);
PQCLEAN_LEDAKEMLT52_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); PQCLEAN_LEDAKEMLT52_LEAKTIME_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b);
} }
@ -123,18 +122,22 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]) {
DIGIT mask = (DIGIT)0x1; DIGIT mask = (DIGIT)0x1;
DIGIT rev1, rev2, a00; DIGIT rev1, rev2, a00;
int i, slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P; int slack_bits_amount = NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_b - P;
a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask; a00 = A[NUM_DIGITS_GF2X_ELEMENT - 1] & mask;
right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A); right_bit_shift(NUM_DIGITS_GF2X_ELEMENT, A);
for (i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) { for (size_t i = NUM_DIGITS_GF2X_ELEMENT - 1; i >= (NUM_DIGITS_GF2X_ELEMENT + 1) / 2; i--) {
rev1 = reverse_digit(A[i]); rev1 = reverse_digit(A[i]);
rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]); rev2 = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT - 1 - i]);
A[i] = rev2; A[i] = rev2;
A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1;
} }
if (NUM_DIGITS_GF2X_ELEMENT % 2 == 1) {
A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]);
}
if (slack_bits_amount) { if (slack_bits_amount) {
PQCLEAN_LEDAKEMLT52_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); PQCLEAN_LEDAKEMLT52_LEAKTIME_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount);
} }
@ -151,10 +154,9 @@ static void rotate_bit_right(DIGIT in[]) { /* x^{-1} * in(x) mod x^P+1 */
} }
/* cond swap: swaps digits A and B if swap_mask == -1 */ /* cond swap: swaps digits A and B if swap_mask == -1 */
static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) { static void gf2x_cswap(DIGIT *a, DIGIT *b, int32_t swap_mask) {
int i;
DIGIT t; DIGIT t;
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
t = swap_mask & (a[i] ^ b[i]); t = swap_mask & (a[i] ^ b[i]);
a[i] ^= t; a[i] ^= t;
b[i] ^= t; b[i] ^= t;
@ -162,18 +164,18 @@ static void gf2x_cswap(DIGIT *a, DIGIT *b, int swap_mask) {
} }
/* returns -1 mask if x != 0, otherwise 0 */ /* returns -1 mask if x != 0, otherwise 0 */
static inline int nonzero(DIGIT x) { static inline int32_t nonzero(DIGIT x) {
DIGIT t = x; DIGIT t = x;
t = (~t) + 1; t = (~t) + 1;
t >>= DIGIT_SIZE_b - 1; t >>= DIGIT_SIZE_b - 1;
return -((int)t); return -((int32_t)t);
} }
/* returns -1 mask if x < 0 else 0 */ /* returns -1 mask if x < 0 else 0 */
static inline int negative(int x) { static inline int32_t negative(int x) {
uint32_t u = x; uint32_t u = x;
u >>= 31; u >>= 31;
return -((int)u); return -((int32_t)u);
} }
/* return f(0) as digit */ /* return f(0) as digit */
@ -191,7 +193,7 @@ static void gf2x_mult_scalar_acc(DIGIT *f, const DIGIT *g, const DIGIT s) {
/* constant-time inverse, source: gcd.cr.yp.to */ /* constant-time inverse, source: gcd.cr.yp.to */
int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) {
int i, loop, swap, delta = 1; int32_t swap, delta = 1;
DIGIT g0_mask; DIGIT g0_mask;
DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1 DIGIT f[NUM_DIGITS_GF2X_MODULUS] = {0}; // f = x^P + 1
@ -202,17 +204,17 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[])
f[NUM_DIGITS_GF2X_MODULUS - 1] = 1; f[NUM_DIGITS_GF2X_MODULUS - 1] = 1;
f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS); f[0] |= ((DIGIT)1 << MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS);
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
g[i] = in[i]; g[i] = in[i];
} }
for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { for (size_t i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) {
v[i] = 0; v[i] = 0;
} }
r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1; r[NUM_DIGITS_GF2X_ELEMENT - 1] = 1;
for (loop = 0; loop < 2 * P - 1; ++loop) { for (int loop = 0; loop < 2 * P - 1; ++loop) {
swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0 swap = negative(-delta) & nonzero(lsb(g)); // swap = -1 if -delta < 0 AND g(0) != 0
delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap delta ^= swap & (delta ^ -delta); // cond swap delta with -delta if swap
@ -247,7 +249,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], con
/*PRE: the representation of the sparse coefficients is sorted in increasing /*PRE: the representation of the sparse coefficients is sorted in increasing
order of the coefficients themselves */ order of the coefficients themselves */
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[],
POSITION_T sparse[], unsigned int nPos) { POSITION_T sparse[], size_t nPos) {
DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; DIGIT aux[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00};
DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00}; DIGIT resDouble[2 * NUM_DIGITS_GF2X_ELEMENT] = {0x00};
@ -258,7 +260,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]); left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, resDouble, sparse[0]);
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]); left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, sparse[0]);
for (unsigned int i = 1; i < nPos; i++) { for (size_t i = 1; i < nPos; i++) {
if (sparse[i] != INVALID_POS_VALUE) { if (sparse[i] != INVALID_POS_VALUE) {
left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) ); left_bit_shift_wide_n(2 * NUM_DIGITS_GF2X_ELEMENT, aux, (sparse[i] - sparse[i - 1]) );
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT); PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_add(resDouble, aux, resDouble, 2 * NUM_DIGITS_GF2X_ELEMENT);
@ -270,10 +272,9 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], cons
} }
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]) { void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]) {
POSITION_T t; POSITION_T t;
int i = 0, j; size_t i = 0, j;
if (A[i] == 0) { if (A[i] == 0) {
i = 1; i = 1;
@ -297,6 +298,9 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
size_t sizeB, const POSITION_T B[]) { size_t sizeB, const POSITION_T B[]) {
POSITION_T prod; POSITION_T prod;
POSITION_T lastReadPos;
size_t duplicateCount;
size_t write_idx, read_idx;
/* compute all the coefficients, filling invalid positions with P*/ /* compute all the coefficients, filling invalid positions with P*/
size_t lastFilledPos = 0; size_t lastFilledPos = 0;
@ -317,12 +321,11 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
Res[lastFilledPos] = INVALID_POS_VALUE; Res[lastFilledPos] = INVALID_POS_VALUE;
lastFilledPos++; lastFilledPos++;
} }
PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(Res, sizeR); PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(Res, sizeR);
/* eliminate duplicates */ /* eliminate duplicates */
POSITION_T lastReadPos = Res[0]; write_idx = read_idx = 0;
size_t duplicateCount;
size_t write_idx = 0;
size_t read_idx = 0;
while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) { while (read_idx < sizeR && Res[read_idx] != INVALID_POS_VALUE) {
lastReadPos = Res[read_idx]; lastReadPos = Res[read_idx];
read_idx++; read_idx++;
@ -344,13 +347,12 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T R
/* the implementation is safe even in case A or B alias with the result /* the implementation is safe even in case A or B alias with the result
* PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */ * PRE: A and B should be sorted, disjunct arrays ending with INVALID_POS_VALUE */
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse( void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[],
int sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[],
int sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]) {
int sizeB, const POSITION_T B[]) {
POSITION_T tmpRes[DV * M]; POSITION_T tmpRes[DV * M];
int idxA = 0, idxB = 0, idxR = 0; size_t idxA = 0, idxB = 0, idxR = 0;
while ( idxA < sizeA && while ( idxA < sizeA &&
idxB < sizeB && idxB < sizeB &&
A[idxA] != INVALID_POS_VALUE && A[idxA] != INVALID_POS_VALUE &&
@ -419,18 +421,18 @@ static uint32_t rand_range(const unsigned int n, const int logn, AES_XOF_struct
/* Obtains fresh randomness and seed-expands it until all the required positions /* Obtains fresh randomness and seed-expands it until all the required positions
* for the '1's in the circulant block are obtained */ * for the '1's in the circulant block are obtained */
void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones,
int countOnes, size_t countOnes,
AES_XOF_struct *seed_expander_ctx) { AES_XOF_struct *seed_expander_ctx) {
int duplicated, placedOnes = 0; size_t duplicated, placedOnes = 0;
uint32_t p; POSITION_T p;
while (placedOnes < countOnes) { while (placedOnes < countOnes) {
p = rand_range(NUM_BITS_GF2X_ELEMENT, p = rand_range(NUM_BITS_GF2X_ELEMENT,
P_BITS, P_BITS,
seed_expander_ctx); seed_expander_ctx);
duplicated = 0; duplicated = 0;
for (int j = 0; j < placedOnes; j++) { for (size_t j = 0; j < placedOnes; j++) {
if (pos_ones[j] == p) { if (pos_ones[j] == p) {
duplicated = 1; duplicated = 1;
} }

16
crypto_kem/ledakemlt52/leaktime/gf2x_arith_mod_xPplusOne.h
View File

@ -16,22 +16,22 @@
#define P_BITS (18) #define P_BITS (18)
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_copy(DIGIT dest[], const DIGIT in[]);
DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], unsigned int exponent); DIGIT PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_get_coeff(const DIGIT poly[], size_t exponent);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT value); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(DIGIT poly[], size_t exponent, DIGIT value);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_toggle_coeff(DIGIT poly[], size_t exponent);
int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(DIGIT *poly); int PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(const DIGIT *poly);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(DIGIT A[]);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_sparse_block(POSITION_T *pos_ones, size_t countOnes, AES_XOF_struct *seed_expander_ctx);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx); void PQCLEAN_LEDAKEMLT52_LEAKTIME_rand_error_pos(POSITION_T errorPos[NUM_ERRORS_T], AES_XOF_struct *seed_expander_ctx);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]); void PQCLEAN_LEDAKEMLT52_LEAKTIME_expand_error(DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], const POSITION_T errorPos[NUM_ERRORS_T]);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place_sparse(size_t sizeA, POSITION_T A[]);
int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); int PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], size_t nPos);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly);
void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes); void PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_frombytes(DIGIT *poly, const uint8_t *poly_bytes);

11
crypto_kem/ledakemlt52/leaktime/kem.c
View File

@ -107,10 +107,11 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH]; uint8_t hashed_decoded_seed[HASH_BYTE_LENGTH];
uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0}; uint8_t hashedAndTruncated_decoded_seed[TRNG_BYTE_LENGTH] = {0};
uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0}; uint8_t ss_input[2 * TRNG_BYTE_LENGTH], tail[TRNG_BYTE_LENGTH] = {0};
int decode_ok, decrypt_ok, equal;
unpack_ct(syndrome, ct); unpack_ct(syndrome, ct);
int decode_ok = PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(decoded_error_vector, decode_ok = PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(decoded_error_vector,
(const privateKeyNiederreiter_t *)sk, syndrome); (const privateKeyNiederreiter_t *)sk, syndrome);
pack_error(decoded_error_bytes, decoded_error_vector); pack_error(decoded_error_bytes, decoded_error_vector);
@ -118,7 +119,7 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH); memcpy(hashedAndTruncatedErrorVector, hashedErrorVector, TRNG_BYTE_LENGTH);
for (int i = 0; i < TRNG_BYTE_LENGTH; ++i) { for (size_t i = 0; i < TRNG_BYTE_LENGTH; ++i) {
decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^ decoded_seed[i] = ct[(NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + i] ^
hashedAndTruncatedErrorVector[i]; hashedAndTruncatedErrorVector[i];
} }
@ -135,11 +136,11 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
PQCLEAN_LEDAKEMLT52_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos); PQCLEAN_LEDAKEMLT52_LEAKTIME_expand_error(reconstructed_error_vector, reconstructed_errorPos);
int equal = PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_verify(decoded_error_vector, equal = PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_verify(decoded_error_vector,
reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT); reconstructed_error_vector, N0 * NUM_DIGITS_GF2X_ELEMENT);
// equal == 0, if the reconstructed error vector match !!! // equal == 0, if the reconstructed error vector match !!!
int decryptOk = (decode_ok == 1 && equal == 0); decrypt_ok = (decode_ok == 1 && equal == 0);
memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH); memcpy(ss_input, decoded_seed, TRNG_BYTE_LENGTH);
memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH); memcpy(ss_input + sizeof(decoded_seed), tail, TRNG_BYTE_LENGTH);
@ -148,7 +149,7 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
PQCLEAN_LEDAKEMLT52_LEAKTIME_cmov(ss_input + sizeof(decoded_seed), PQCLEAN_LEDAKEMLT52_LEAKTIME_cmov(ss_input + sizeof(decoded_seed),
((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret, ((const privateKeyNiederreiter_t *) sk)->decryption_failure_secret,
TRNG_BYTE_LENGTH, TRNG_BYTE_LENGTH,
!decryptOk); !decrypt_ok);
HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH); HASH_FUNCTION(ss, ss_input, 2 * TRNG_BYTE_LENGTH);

44
crypto_kem/ledakemlt52/leaktime/niederreiter.c
View File

@ -49,7 +49,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p
} }
} }
is_L_full = 1; is_L_full = 1;
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE); is_L_full = is_L_full && (LPosOnes[i][DV * M - 1] != INVALID_POS_VALUE);
} }
sk->rejections = sk->rejections + 1; sk->rejections = sk->rejections + 1;
@ -63,21 +63,21 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_keygen(publicKeyNiederreiter_t *p
sk->decryption_failure_secret, sk->decryption_failure_secret,
(unsigned long)TRNG_BYTE_LENGTH); (unsigned long)TRNG_BYTE_LENGTH);
for (int j = 0; j < DV * M; j++) { for (size_t j = 0; j < DV * M; j++) {
if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) { if (LPosOnes[N0 - 1][j] != INVALID_POS_VALUE) {
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1); PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_set_coeff(Ln0dense, LPosOnes[N0 - 1][j], 1);
} }
} }
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense); PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_inverse(Ln0Inv, Ln0dense);
for (int i = 0; i < N0 - 1; i++) { for (size_t i = 0; i < N0 - 1; i++) {
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_dense_to_sparse(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT,
Ln0Inv, Ln0Inv,
LPosOnes[i], LPosOnes[i],
DV * M); DV * M);
} }
for (int i = 0; i < N0 - 1; i++) { for (size_t i = 0; i < N0 - 1; i++) {
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT); PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_transpose_in_place(pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT);
} }
} }
@ -110,24 +110,27 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
POSITION_T auxSparse[DV * M]; POSITION_T auxSparse[DV * M];
POSITION_T Ln0trSparse[DV * M]; POSITION_T Ln0trSparse[DV * M];
DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0}; DIGIT err_computed[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B] = {0};
DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B];
DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT];
unsigned char processedQOnes[N0]; uint8_t processedQOnes[N0];
int rejections = sk->rejections; int rejections = sk->rejections;
int decrypt_ok = 0;
int err_weight;
PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed);
do { do {
PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander); PQCLEAN_LEDAKEMLT52_LEAKTIME_generateHPosOnes(HPosOnes, &niederreiter_decrypt_expander);
PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander); PQCLEAN_LEDAKEMLT52_LEAKTIME_generateQPosOnes(QPosOnes, &niederreiter_decrypt_expander);
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
for (int j = 0; j < DV * M; j++) { for (size_t j = 0; j < DV * M; j++) {
LPosOnes[i][j] = INVALID_POS_VALUE; LPosOnes[i][j] = INVALID_POS_VALUE;
} }
} }
memset(processedQOnes, 0x00, sizeof(processedQOnes)); memset(processedQOnes, 0x00, sizeof(processedQOnes));
for (int colQ = 0; colQ < N0; colQ++) { for (size_t colQ = 0; colQ < N0; colQ++) {
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes, PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxPosOnes,
DV, HPosOnes[i], DV, HPosOnes[i],
qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]); qBlockWeights[i][colQ], QPosOnes[i] + processedQOnes[i]);
@ -143,15 +146,15 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes); PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeHPosOnes(HtrPosOnes, HPosOnes);
PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes); PQCLEAN_LEDAKEMLT52_LEAKTIME_transposeQPosOnes(QtrPosOnes, QPosOnes);
for (int i = 0; i < DV * M; i++) { for (size_t i = 0; i < DV * M; i++) {
Ln0trSparse[i] = INVALID_POS_VALUE; Ln0trSparse[i] = INVALID_POS_VALUE;
auxSparse[i] = INVALID_POS_VALUE; auxSparse[i] = INVALID_POS_VALUE;
} }
for (int i = 0; i < N0; i++) { for (size_t i = 0; i < N0; i++) {
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse, PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_mul_sparse(DV * M, auxSparse,
DV, HPosOnes[i], DV, HPosOnes[i],
qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1] ] ); qBlockWeights[i][N0 - 1], &QPosOnes[i][M - qBlockWeights[i][N0 - 1]]);
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse, PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_mod_add_sparse(DV * M, Ln0trSparse,
DV * M, Ln0trSparse, DV * M, Ln0trSparse,
DV * M, auxSparse); DV * M, auxSparse);
@ -163,28 +166,27 @@ int PQCLEAN_LEDAKEMLT52_LEAKTIME_niederreiter_decrypt(DIGIT *err, const privateK
Ln0trSparse, Ln0trSparse,
DV * M); DV * M);
int decryptOk = 0; decrypt_ok = PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(err_computed,
decryptOk = PQCLEAN_LEDAKEMLT52_LEAKTIME_bf_decoding(err_computed,
(const POSITION_T (*)[DV]) HtrPosOnes, (const POSITION_T (*)[DV]) HtrPosOnes,
(const POSITION_T (*)[M]) QtrPosOnes, (const POSITION_T (*)[M]) QtrPosOnes,
privateSyndrome, sk->secondIterThreshold); privateSyndrome, sk->secondIterThreshold);
int err_weight = 0; err_weight = 0;
for (int i = 0 ; i < N0; i++) { for (size_t i = 0 ; i < N0; i++) {
err_weight += PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i)); err_weight += PQCLEAN_LEDAKEMLT52_LEAKTIME_population_count(err_computed + (NUM_DIGITS_GF2X_ELEMENT * i));
} }
decryptOk = decryptOk && (err_weight == NUM_ERRORS_T); decrypt_ok = decrypt_ok && (err_weight == NUM_ERRORS_T);
/* prepare mockup error vector in case a decoding failure occurs */ /* prepare mockup error vector in case a decoding failure occurs */
DIGIT err_mockup[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B];
memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); memcpy(err_mockup, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH); memcpy(err_mockup + NUM_DIGITS_GF2X_ELEMENT, sk->decryption_failure_secret, TRNG_BYTE_LENGTH);
memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00, memset(((unsigned char *) err_mockup) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B) + TRNG_BYTE_LENGTH, 0x00,
(N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH); (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B - TRNG_BYTE_LENGTH);
memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); memcpy(err, err_computed, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B);
// Overwrite on decryption failure
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decryptOk);
return decryptOk; // Overwrite on decryption failure
PQCLEAN_LEDAKEMLT52_LEAKTIME_gf2x_cmov(err, err_mockup, N0 * NUM_DIGITS_GF2X_ELEMENT, !decrypt_ok);
return decrypt_ok;
} }

12
crypto_kem/ledakemlt52/leaktime/rng.c
View File

@ -13,8 +13,8 @@
maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier maxlen - maximum number of bytes (less than 2**32) generated under this seed and diversifier
*/ */
static void seedexpander_init(AES_XOF_struct *ctx, static void seedexpander_init(AES_XOF_struct *ctx,
unsigned char *seed, uint8_t *seed,
unsigned char *diversifier, uint8_t *diversifier,
size_t maxlen) { size_t maxlen) {
ctx->length_remaining = maxlen; ctx->length_remaining = maxlen;
@ -38,13 +38,13 @@ static void seedexpander_init(AES_XOF_struct *ctx,
} }
void PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx, void PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx,
const unsigned char *trng_entropy const uint8_t *trng_entropy
/* TRNG_BYTE_LENGTH wide buffer */) { /* TRNG_BYTE_LENGTH wide buffer */) {
/*the NIST seedexpander will however access 32B from this buffer */ /*the NIST seedexpander will however access 32B from this buffer */
unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH; unsigned int prng_buffer_size = TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH;
unsigned char prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = { 0x00 }; uint8_t prng_buffer[TRNG_BYTE_LENGTH < 32 ? 32 : TRNG_BYTE_LENGTH] = {0x00};
unsigned char *diversifier = ((unsigned char *)trng_entropy) + 32; uint8_t *diversifier = (uint8_t *)trng_entropy + 32;
memcpy(prng_buffer, memcpy(prng_buffer,
trng_entropy, trng_entropy,
@ -61,7 +61,7 @@ void PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander_from_trng(AES_XOF_struct *ctx,
x - returns the XOF data x - returns the XOF data
xlen - number of bytes to return xlen - number of bytes to return
*/ */
int PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen) { int PQCLEAN_LEDAKEMLT52_LEAKTIME_seedexpander(AES_XOF_struct *ctx, uint8_t *x, size_t xlen) {
size_t offset; size_t offset;
aes256ctx ctx256; aes256ctx ctx256;

11
crypto_kem/ledakemlt52/leaktime/sort.c
View File

@ -5,6 +5,17 @@
Source: https://sorting.cr.yp.to Source: https://sorting.cr.yp.to
*/ */
#define int32_MINMAX(a,b) \
do { \
int32 ab = (b) ^ (a); \
int32 c = (b) - (a); \
c ^= ab & (c ^ (b)); \
c >>= 31; \
c &= ab; \
(a) ^= c; \
(b) ^= c; \
} while(0)
static void int32_sort(int32 *x, size_t n) { static void int32_sort(int32 *x, size_t n) {
size_t top, p, q, r, i, j; size_t top, p, q, r, i, j;

11
crypto_kem/ledakemlt52/leaktime/sort.h
View File

@ -6,17 +6,6 @@
#define int32 int32_t #define int32 int32_t
#define int32_MINMAX(a,b) \
do { \
int32 ab = (b) ^ (a); \
int32 c = (b) - (a); \
c ^= ab & (c ^ (b)); \
c >>= 31; \
c &= ab; \
(a) ^= c; \
(b) ^= c; \
} while(0)
void PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(uint32_t *x, size_t n); void PQCLEAN_LEDAKEMLT52_LEAKTIME_uint32_sort(uint32_t *x, size_t n);
#endif #endif

3
test/duplicate_consistency/ledakemlt12_leaktime.yml
View File

@ -7,6 +7,7 @@ consistency_checks:
- dfr_test.c - dfr_test.c
- dfr_test.h - dfr_test.h
- gf2x_arith.c - gf2x_arith.c
- gf2x_arith_mod_xPplusOne.c
- H_Q_matrices_generation.c - H_Q_matrices_generation.c
- H_Q_matrices_generation.h - H_Q_matrices_generation.h
- kem.c - kem.c
@ -24,6 +25,7 @@ consistency_checks:
- dfr_test.c - dfr_test.c
- dfr_test.h - dfr_test.h
- gf2x_arith.c - gf2x_arith.c
- gf2x_arith_mod_xPplusOne.c
- H_Q_matrices_generation.c - H_Q_matrices_generation.c
- H_Q_matrices_generation.h - H_Q_matrices_generation.h
- kem.c - kem.c
@ -32,4 +34,3 @@ consistency_checks:
- rng.h - rng.h
- utils.c - utils.c
- utils.h - utils.h

3
test/duplicate_consistency/ledakemlt32_leaktime.yml
View File

@ -7,6 +7,7 @@ consistency_checks:
- dfr_test.c - dfr_test.c
- dfr_test.h - dfr_test.h
- gf2x_arith.c - gf2x_arith.c
- gf2x_arith_mod_xPplusOne.c
- H_Q_matrices_generation.c - H_Q_matrices_generation.c
- H_Q_matrices_generation.h - H_Q_matrices_generation.h
- kem.c - kem.c
@ -24,6 +25,7 @@ consistency_checks:
- dfr_test.c - dfr_test.c
- dfr_test.h - dfr_test.h
- gf2x_arith.c - gf2x_arith.c
- gf2x_arith_mod_xPplusOne.c
- H_Q_matrices_generation.c - H_Q_matrices_generation.c
- H_Q_matrices_generation.h - H_Q_matrices_generation.h
- kem.c - kem.c
@ -32,4 +34,3 @@ consistency_checks:
- rng.h - rng.h
- utils.c - utils.c
- utils.h - utils.h

2
test/duplicate_consistency/ledakemlt52_leaktime.yml
View File

@ -7,6 +7,7 @@ consistency_checks:
- dfr_test.c - dfr_test.c
- dfr_test.h - dfr_test.h
- gf2x_arith.c - gf2x_arith.c
- gf2x_arith_mod_xPplusOne.c
- H_Q_matrices_generation.c - H_Q_matrices_generation.c
- H_Q_matrices_generation.h - H_Q_matrices_generation.h
- kem.c - kem.c
@ -32,4 +33,3 @@ consistency_checks:
- rng.h - rng.h
- utils.c - utils.c
- utils.h - utils.h