kris/pqcrypto
1
1
Fork 0
mirror of https://github.com/henrydcase/pqc.git synced 2024-11-22 23:48:58 +00:00
Code Issues 1 Releases Wiki Activity

Update NTRU

Browse Source 
Oussama Danba caught a bug in how we were handing a test related to
ciphertext encoding. Not a security issue as far as we can tell, but
certainly not the correct behavior.

More detail here: e0ab9525f1

This commit also switches ntruhrss701/avx2/poly_S3_inv to the
Bernstein--Yang code, also slightly simplifies the poly_Rq_to_S3
routine.
This commit is contained in:
John M. Schanck 2020-10-09 15:13:48 -04:00 committed by Kris Kwiatkowski
parent ba7ac6f316
commit b5dab8de93
23 changed files with 4556 additions and 9753 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
crypto_kem/ntruhps2048509/META.yml
View File

@ -23,9 +23,9 @@ auxiliary-submitters:
- Zhenfei Zhang - Zhenfei Zhang
implementations: implementations:
- name: clean - name: clean
version: https://github.com/jschanck/ntru/tree/2d4df948 reference implementation version: https://github.com/jschanck/ntru/tree/b38a346a reference implementation
- name: avx2 - name: avx2
version: https://github.com/jschanck/ntru/tree/2d4df948 avx2 implementation version: https://github.com/jschanck/ntru/tree/b38a346a avx2 implementation
supported_platforms: supported_platforms:
- architecture: x86_64 - architecture: x86_64
operating_systems: operating_systems:

77
crypto_kem/ntruhps2048509/avx2/owcpa.c
View File

@ -2,40 +2,59 @@
#include "poly.h" #include "poly.h"
#include "sample.h" #include "sample.h"
static int owcpa_check_r(const poly *r) { static int owcpa_check_ciphertext(const unsigned char *ciphertext) {
/* Check that r is in message space. */ /* A ciphertext is log2(q)*(n-1) bits packed into bytes. */
/* Note: Assumes that r has coefficients in {0, 1, ..., q-1} */ /* Check that any unused bits of the final byte are zero. */
int i;
uint64_t t = 0; uint16_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N; i++) { t = ciphertext[NTRU_CIPHERTEXTBYTES - 1];
c = MODQ(r->coeffs[i] + 1); t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)));
t |= c & (NTRU_Q - 4); /* 0 if c is in {0,1,2,3} */
t |= (c + 1) & 0x4; /* 0 if c is in {0,1,2} */ /* We have 0 <= t < 256 */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 15));
} }
t |= MODQ(r->coeffs[NTRU_N - 1]); /* Coefficient n-1 must be zero */
t = (~t + 1); // two's complement static int owcpa_check_r(const poly *r) {
t >>= 63; /* A valid r has coefficients in {0,1,q-1} and has r[N-1] = 0 */
return (int) t; /* Note: We may assume that 0 <= r[i] <= q-1 for all i */
int i;
uint32_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N - 1; i++) {
c = r->coeffs[i];
t |= (c + 1) & (NTRU_Q - 4); /* 0 iff c is in {-1,0,1,2} */
t |= (c + 2) & 4; /* 1 if c = 2, 0 if c is in {-1,0,1} */
}
t |= r->coeffs[NTRU_N - 1]; /* Coefficient n-1 must be zero */
/* We have 0 <= t < 2^16. */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 31));
} }
static int owcpa_check_m(const poly *m) { static int owcpa_check_m(const poly *m) {
/* Check that m is in message space. */ /* Check that m is in message space, i.e. */
/* Note: Assumes that m has coefficients in {0,1,2}. */ /* (1) |{i : m[i] = 1}| = |{i : m[i] = 2}|, and */
/* (2) |{i : m[i] != 0}| = NTRU_WEIGHT. */
/* Note: We may assume that m has coefficients in {0,1,2}. */
int i; int i;
uint64_t t = 0; uint32_t t = 0;
uint16_t p1 = 0; uint16_t ps = 0;
uint16_t m1 = 0; uint16_t ms = 0;
for (i = 0; i < NTRU_N; i++) { for (i = 0; i < NTRU_N; i++) {
p1 += m->coeffs[i] & 0x01; ps += m->coeffs[i] & 1;
m1 += (m->coeffs[i] & 0x02) >> 1; ms += m->coeffs[i] & 2;
} }
/* Need p1 = m1 and p1 + m1 = NTRU_WEIGHT */ t |= ps ^ (ms >> 1); /* 0 if (1) holds */
t |= p1 ^ m1; t |= ms ^ NTRU_WEIGHT; /* 0 if (1) and (2) hold */
t |= (p1 + m1) ^ NTRU_WEIGHT;
t = (~t + 1); // two's complement /* We have 0 <= t < 2^16. */
t >>= 63; /* Return 0 on success (t=0), 1 on failure */
return (int) t; return (int) (1 & ((~t + 1) >> 31));
} }
void PQCLEAN_NTRUHPS2048509_AVX2_owcpa_keypair(unsigned char *pk, void PQCLEAN_NTRUHPS2048509_AVX2_owcpa_keypair(unsigned char *pk,
@ -125,8 +144,8 @@ int PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec(unsigned char *rm,
fail = 0; fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */ /* Check that the unused bits of the last byte of the ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)))); fail |= owcpa_check_ciphertext(ciphertext);
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */ /* We can avoid re-computing r*h + Lift(m) as long as we check that */

1447
crypto_kem/ntruhps2048509/avx2/poly_rq_to_s3.s
View File

File diff suppressed because it is too large Load Diff

77
crypto_kem/ntruhps2048509/clean/owcpa.c
View File

@ -2,40 +2,59 @@
#include "poly.h" #include "poly.h"
#include "sample.h" #include "sample.h"
static int owcpa_check_r(const poly *r) { static int owcpa_check_ciphertext(const unsigned char *ciphertext) {
/* Check that r is in message space. */ /* A ciphertext is log2(q)*(n-1) bits packed into bytes. */
/* Note: Assumes that r has coefficients in {0, 1, ..., q-1} */ /* Check that any unused bits of the final byte are zero. */
int i;
uint64_t t = 0; uint16_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N; i++) { t = ciphertext[NTRU_CIPHERTEXTBYTES - 1];
c = MODQ(r->coeffs[i] + 1); t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)));
t |= c & (NTRU_Q - 4); /* 0 if c is in {0,1,2,3} */
t |= (c + 1) & 0x4; /* 0 if c is in {0,1,2} */ /* We have 0 <= t < 256 */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 15));
} }
t |= MODQ(r->coeffs[NTRU_N - 1]); /* Coefficient n-1 must be zero */
t = (~t + 1); // two's complement static int owcpa_check_r(const poly *r) {
t >>= 63; /* A valid r has coefficients in {0,1,q-1} and has r[N-1] = 0 */
return (int) t; /* Note: We may assume that 0 <= r[i] <= q-1 for all i */
int i;
uint32_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N - 1; i++) {
c = r->coeffs[i];
t |= (c + 1) & (NTRU_Q - 4); /* 0 iff c is in {-1,0,1,2} */
t |= (c + 2) & 4; /* 1 if c = 2, 0 if c is in {-1,0,1} */
}
t |= r->coeffs[NTRU_N - 1]; /* Coefficient n-1 must be zero */
/* We have 0 <= t < 2^16. */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 31));
} }
static int owcpa_check_m(const poly *m) { static int owcpa_check_m(const poly *m) {
/* Check that m is in message space. */ /* Check that m is in message space, i.e. */
/* Note: Assumes that m has coefficients in {0,1,2}. */ /* (1) |{i : m[i] = 1}| = |{i : m[i] = 2}|, and */
/* (2) |{i : m[i] != 0}| = NTRU_WEIGHT. */
/* Note: We may assume that m has coefficients in {0,1,2}. */
int i; int i;
uint64_t t = 0; uint32_t t = 0;
uint16_t p1 = 0; uint16_t ps = 0;
uint16_t m1 = 0; uint16_t ms = 0;
for (i = 0; i < NTRU_N; i++) { for (i = 0; i < NTRU_N; i++) {
p1 += m->coeffs[i] & 0x01; ps += m->coeffs[i] & 1;
m1 += (m->coeffs[i] & 0x02) >> 1; ms += m->coeffs[i] & 2;
} }
/* Need p1 = m1 and p1 + m1 = NTRU_WEIGHT */ t |= ps ^ (ms >> 1); /* 0 if (1) holds */
t |= p1 ^ m1; t |= ms ^ NTRU_WEIGHT; /* 0 if (1) and (2) hold */
t |= (p1 + m1) ^ NTRU_WEIGHT;
t = (~t + 1); // two's complement /* We have 0 <= t < 2^16. */
t >>= 63; /* Return 0 on success (t=0), 1 on failure */
return (int) t; return (int) (1 & ((~t + 1) >> 31));
} }
void PQCLEAN_NTRUHPS2048509_CLEAN_owcpa_keypair(unsigned char *pk, void PQCLEAN_NTRUHPS2048509_CLEAN_owcpa_keypair(unsigned char *pk,
@ -125,8 +144,8 @@ int PQCLEAN_NTRUHPS2048509_CLEAN_owcpa_dec(unsigned char *rm,
fail = 0; fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */ /* Check that the unused bits of the last byte of the ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)))); fail |= owcpa_check_ciphertext(ciphertext);
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */ /* We can avoid re-computing r*h + Lift(m) as long as we check that */

18
crypto_kem/ntruhps2048509/clean/poly_mod.c
View File

@ -30,14 +30,22 @@ void PQCLEAN_NTRUHPS2048509_CLEAN_poly_mod_q_Phi_n(poly *r) {
} }
void PQCLEAN_NTRUHPS2048509_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) { void PQCLEAN_NTRUHPS2048509_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) {
/* NOTE: Assumes input is in [0,Q-1]^N */
/* Produces output in {0,1,2}^N */
int i; int i;
uint16_t flag;
/* Center coeffs around 3Q: [0, Q-1] -> [3Q - Q/2, 3Q + Q/2) */ /* The coefficients of a are stored as non-negative integers. */
/* We must translate to representatives in [-q/2, q/2) before */
/* reduction mod 3. */
for (i = 0; i < NTRU_N; i++) { for (i = 0; i < NTRU_N; i++) {
r->coeffs[i] = ((MODQ(a->coeffs[i]) >> (NTRU_LOGQ - 1)) ^ 3) << NTRU_LOGQ; /* Need an explicit reduction mod q here */
r->coeffs[i] += MODQ(a->coeffs[i]); r->coeffs[i] = MODQ(a->coeffs[i]);
/* flag = 1 if r[i] >= q/2 else 0 */
flag = r->coeffs[i] >> (NTRU_LOGQ - 1);
/* Now we will add (-q) mod 3 if r[i] >= q/2 */
/* Note (-q) mod 3=(-2^k) mod 3=1<<(1-(k&1)) */
r->coeffs[i] += flag << (1 - (NTRU_LOGQ & 1));
} }
PQCLEAN_NTRUHPS2048509_CLEAN_poly_mod_3_Phi_n(r); PQCLEAN_NTRUHPS2048509_CLEAN_poly_mod_3_Phi_n(r);

4
crypto_kem/ntruhps2048677/META.yml
View File

@ -23,9 +23,9 @@ auxiliary-submitters:
- Zhenfei Zhang - Zhenfei Zhang
implementations: implementations:
- name: clean - name: clean
version: https://github.com/jschanck/ntru/tree/2d4df948 reference implementation version: https://github.com/jschanck/ntru/tree/b38a346a reference implementation
- name: avx2 - name: avx2
version: https://github.com/jschanck/ntru/tree/2d4df948 avx2 implementation version: https://github.com/jschanck/ntru/tree/b38a346a avx2 implementation
supported_platforms: supported_platforms:
- architecture: x86_64 - architecture: x86_64
operating_systems: operating_systems:

77
crypto_kem/ntruhps2048677/avx2/owcpa.c
View File

@ -2,40 +2,59 @@
#include "poly.h" #include "poly.h"
#include "sample.h" #include "sample.h"
static int owcpa_check_r(const poly *r) { static int owcpa_check_ciphertext(const unsigned char *ciphertext) {
/* Check that r is in message space. */ /* A ciphertext is log2(q)*(n-1) bits packed into bytes. */
/* Note: Assumes that r has coefficients in {0, 1, ..., q-1} */ /* Check that any unused bits of the final byte are zero. */
int i;
uint64_t t = 0; uint16_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N; i++) { t = ciphertext[NTRU_CIPHERTEXTBYTES - 1];
c = MODQ(r->coeffs[i] + 1); t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)));
t |= c & (NTRU_Q - 4); /* 0 if c is in {0,1,2,3} */
t |= (c + 1) & 0x4; /* 0 if c is in {0,1,2} */ /* We have 0 <= t < 256 */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 15));
} }
t |= MODQ(r->coeffs[NTRU_N - 1]); /* Coefficient n-1 must be zero */
t = (~t + 1); // two's complement static int owcpa_check_r(const poly *r) {
t >>= 63; /* A valid r has coefficients in {0,1,q-1} and has r[N-1] = 0 */
return (int) t; /* Note: We may assume that 0 <= r[i] <= q-1 for all i */
int i;
uint32_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N - 1; i++) {
c = r->coeffs[i];
t |= (c + 1) & (NTRU_Q - 4); /* 0 iff c is in {-1,0,1,2} */
t |= (c + 2) & 4; /* 1 if c = 2, 0 if c is in {-1,0,1} */
}
t |= r->coeffs[NTRU_N - 1]; /* Coefficient n-1 must be zero */
/* We have 0 <= t < 2^16. */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 31));
} }
static int owcpa_check_m(const poly *m) { static int owcpa_check_m(const poly *m) {
/* Check that m is in message space. */ /* Check that m is in message space, i.e. */
/* Note: Assumes that m has coefficients in {0,1,2}. */ /* (1) |{i : m[i] = 1}| = |{i : m[i] = 2}|, and */
/* (2) |{i : m[i] != 0}| = NTRU_WEIGHT. */
/* Note: We may assume that m has coefficients in {0,1,2}. */
int i; int i;
uint64_t t = 0; uint32_t t = 0;
uint16_t p1 = 0; uint16_t ps = 0;
uint16_t m1 = 0; uint16_t ms = 0;
for (i = 0; i < NTRU_N; i++) { for (i = 0; i < NTRU_N; i++) {
p1 += m->coeffs[i] & 0x01; ps += m->coeffs[i] & 1;
m1 += (m->coeffs[i] & 0x02) >> 1; ms += m->coeffs[i] & 2;
} }
/* Need p1 = m1 and p1 + m1 = NTRU_WEIGHT */ t |= ps ^ (ms >> 1); /* 0 if (1) holds */
t |= p1 ^ m1; t |= ms ^ NTRU_WEIGHT; /* 0 if (1) and (2) hold */
t |= (p1 + m1) ^ NTRU_WEIGHT;
t = (~t + 1); // two's complement /* We have 0 <= t < 2^16. */
t >>= 63; /* Return 0 on success (t=0), 1 on failure */
return (int) t; return (int) (1 & ((~t + 1) >> 31));
} }
void PQCLEAN_NTRUHPS2048677_AVX2_owcpa_keypair(unsigned char *pk, void PQCLEAN_NTRUHPS2048677_AVX2_owcpa_keypair(unsigned char *pk,
@ -125,8 +144,8 @@ int PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec(unsigned char *rm,
fail = 0; fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */ /* Check that the unused bits of the last byte of the ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)))); fail |= owcpa_check_ciphertext(ciphertext);
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */ /* We can avoid re-computing r*h + Lift(m) as long as we check that */

1951
crypto_kem/ntruhps2048677/avx2/poly_rq_to_s3.s
View File

File diff suppressed because it is too large Load Diff

77
crypto_kem/ntruhps2048677/clean/owcpa.c
View File

@ -2,40 +2,59 @@
#include "poly.h" #include "poly.h"
#include "sample.h" #include "sample.h"
static int owcpa_check_r(const poly *r) { static int owcpa_check_ciphertext(const unsigned char *ciphertext) {
/* Check that r is in message space. */ /* A ciphertext is log2(q)*(n-1) bits packed into bytes. */
/* Note: Assumes that r has coefficients in {0, 1, ..., q-1} */ /* Check that any unused bits of the final byte are zero. */
int i;
uint64_t t = 0; uint16_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N; i++) { t = ciphertext[NTRU_CIPHERTEXTBYTES - 1];
c = MODQ(r->coeffs[i] + 1); t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)));
t |= c & (NTRU_Q - 4); /* 0 if c is in {0,1,2,3} */
t |= (c + 1) & 0x4; /* 0 if c is in {0,1,2} */ /* We have 0 <= t < 256 */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 15));
} }
t |= MODQ(r->coeffs[NTRU_N - 1]); /* Coefficient n-1 must be zero */
t = (~t + 1); // two's complement static int owcpa_check_r(const poly *r) {
t >>= 63; /* A valid r has coefficients in {0,1,q-1} and has r[N-1] = 0 */
return (int) t; /* Note: We may assume that 0 <= r[i] <= q-1 for all i */
int i;
uint32_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N - 1; i++) {
c = r->coeffs[i];
t |= (c + 1) & (NTRU_Q - 4); /* 0 iff c is in {-1,0,1,2} */
t |= (c + 2) & 4; /* 1 if c = 2, 0 if c is in {-1,0,1} */
}
t |= r->coeffs[NTRU_N - 1]; /* Coefficient n-1 must be zero */
/* We have 0 <= t < 2^16. */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 31));
} }
static int owcpa_check_m(const poly *m) { static int owcpa_check_m(const poly *m) {
/* Check that m is in message space. */ /* Check that m is in message space, i.e. */
/* Note: Assumes that m has coefficients in {0,1,2}. */ /* (1) |{i : m[i] = 1}| = |{i : m[i] = 2}|, and */
/* (2) |{i : m[i] != 0}| = NTRU_WEIGHT. */
/* Note: We may assume that m has coefficients in {0,1,2}. */
int i; int i;
uint64_t t = 0; uint32_t t = 0;
uint16_t p1 = 0; uint16_t ps = 0;
uint16_t m1 = 0; uint16_t ms = 0;
for (i = 0; i < NTRU_N; i++) { for (i = 0; i < NTRU_N; i++) {
p1 += m->coeffs[i] & 0x01; ps += m->coeffs[i] & 1;
m1 += (m->coeffs[i] & 0x02) >> 1; ms += m->coeffs[i] & 2;
} }
/* Need p1 = m1 and p1 + m1 = NTRU_WEIGHT */ t |= ps ^ (ms >> 1); /* 0 if (1) holds */
t |= p1 ^ m1; t |= ms ^ NTRU_WEIGHT; /* 0 if (1) and (2) hold */
t |= (p1 + m1) ^ NTRU_WEIGHT;
t = (~t + 1); // two's complement /* We have 0 <= t < 2^16. */
t >>= 63; /* Return 0 on success (t=0), 1 on failure */
return (int) t; return (int) (1 & ((~t + 1) >> 31));
} }
void PQCLEAN_NTRUHPS2048677_CLEAN_owcpa_keypair(unsigned char *pk, void PQCLEAN_NTRUHPS2048677_CLEAN_owcpa_keypair(unsigned char *pk,
@ -125,8 +144,8 @@ int PQCLEAN_NTRUHPS2048677_CLEAN_owcpa_dec(unsigned char *rm,
fail = 0; fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */ /* Check that the unused bits of the last byte of the ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)))); fail |= owcpa_check_ciphertext(ciphertext);
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */ /* We can avoid re-computing r*h + Lift(m) as long as we check that */

18
crypto_kem/ntruhps2048677/clean/poly_mod.c
View File

@ -30,14 +30,22 @@ void PQCLEAN_NTRUHPS2048677_CLEAN_poly_mod_q_Phi_n(poly *r) {
} }
void PQCLEAN_NTRUHPS2048677_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) { void PQCLEAN_NTRUHPS2048677_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) {
/* NOTE: Assumes input is in [0,Q-1]^N */
/* Produces output in {0,1,2}^N */
int i; int i;
uint16_t flag;
/* Center coeffs around 3Q: [0, Q-1] -> [3Q - Q/2, 3Q + Q/2) */ /* The coefficients of a are stored as non-negative integers. */
/* We must translate to representatives in [-q/2, q/2) before */
/* reduction mod 3. */
for (i = 0; i < NTRU_N; i++) { for (i = 0; i < NTRU_N; i++) {
r->coeffs[i] = ((MODQ(a->coeffs[i]) >> (NTRU_LOGQ - 1)) ^ 3) << NTRU_LOGQ; /* Need an explicit reduction mod q here */
r->coeffs[i] += MODQ(a->coeffs[i]); r->coeffs[i] = MODQ(a->coeffs[i]);
/* flag = 1 if r[i] >= q/2 else 0 */
flag = r->coeffs[i] >> (NTRU_LOGQ - 1);
/* Now we will add (-q) mod 3 if r[i] >= q/2 */
/* Note (-q) mod 3=(-2^k) mod 3=1<<(1-(k&1)) */
r->coeffs[i] += flag << (1 - (NTRU_LOGQ & 1));
} }
PQCLEAN_NTRUHPS2048677_CLEAN_poly_mod_3_Phi_n(r); PQCLEAN_NTRUHPS2048677_CLEAN_poly_mod_3_Phi_n(r);

4
crypto_kem/ntruhps4096821/META.yml
View File

@ -23,9 +23,9 @@ auxiliary-submitters:
- Zhenfei Zhang - Zhenfei Zhang
implementations: implementations:
- name: clean - name: clean
version: https://github.com/jschanck/ntru/tree/2d4df948 reference implementation version: https://github.com/jschanck/ntru/tree/b38a346a reference implementation
- name: avx2 - name: avx2
version: https://github.com/jschanck/ntru/tree/2d4df948 avx2 implementation version: https://github.com/jschanck/ntru/tree/b38a346a avx2 implementation
supported_platforms: supported_platforms:
- architecture: x86_64 - architecture: x86_64
operating_systems: operating_systems:

77
crypto_kem/ntruhps4096821/avx2/owcpa.c
View File

@ -2,40 +2,59 @@
#include "poly.h" #include "poly.h"
#include "sample.h" #include "sample.h"
static int owcpa_check_r(const poly *r) { static int owcpa_check_ciphertext(const unsigned char *ciphertext) {
/* Check that r is in message space. */ /* A ciphertext is log2(q)*(n-1) bits packed into bytes. */
/* Note: Assumes that r has coefficients in {0, 1, ..., q-1} */ /* Check that any unused bits of the final byte are zero. */
int i;
uint64_t t = 0; uint16_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N; i++) { t = ciphertext[NTRU_CIPHERTEXTBYTES - 1];
c = MODQ(r->coeffs[i] + 1); t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)));
t |= c & (NTRU_Q - 4); /* 0 if c is in {0,1,2,3} */
t |= (c + 1) & 0x4; /* 0 if c is in {0,1,2} */ /* We have 0 <= t < 256 */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 15));
} }
t |= MODQ(r->coeffs[NTRU_N - 1]); /* Coefficient n-1 must be zero */
t = (~t + 1); // two's complement static int owcpa_check_r(const poly *r) {
t >>= 63; /* A valid r has coefficients in {0,1,q-1} and has r[N-1] = 0 */
return (int) t; /* Note: We may assume that 0 <= r[i] <= q-1 for all i */
int i;
uint32_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N - 1; i++) {
c = r->coeffs[i];
t |= (c + 1) & (NTRU_Q - 4); /* 0 iff c is in {-1,0,1,2} */
t |= (c + 2) & 4; /* 1 if c = 2, 0 if c is in {-1,0,1} */
}
t |= r->coeffs[NTRU_N - 1]; /* Coefficient n-1 must be zero */
/* We have 0 <= t < 2^16. */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 31));
} }
static int owcpa_check_m(const poly *m) { static int owcpa_check_m(const poly *m) {
/* Check that m is in message space. */ /* Check that m is in message space, i.e. */
/* Note: Assumes that m has coefficients in {0,1,2}. */ /* (1) |{i : m[i] = 1}| = |{i : m[i] = 2}|, and */
/* (2) |{i : m[i] != 0}| = NTRU_WEIGHT. */
/* Note: We may assume that m has coefficients in {0,1,2}. */
int i; int i;
uint64_t t = 0; uint32_t t = 0;
uint16_t p1 = 0; uint16_t ps = 0;
uint16_t m1 = 0; uint16_t ms = 0;
for (i = 0; i < NTRU_N; i++) { for (i = 0; i < NTRU_N; i++) {
p1 += m->coeffs[i] & 0x01; ps += m->coeffs[i] & 1;
m1 += (m->coeffs[i] & 0x02) >> 1; ms += m->coeffs[i] & 2;
} }
/* Need p1 = m1 and p1 + m1 = NTRU_WEIGHT */ t |= ps ^ (ms >> 1); /* 0 if (1) holds */
t |= p1 ^ m1; t |= ms ^ NTRU_WEIGHT; /* 0 if (1) and (2) hold */
t |= (p1 + m1) ^ NTRU_WEIGHT;
t = (~t + 1); // two's complement /* We have 0 <= t < 2^16. */
t >>= 63; /* Return 0 on success (t=0), 1 on failure */
return (int) t; return (int) (1 & ((~t + 1) >> 31));
} }
void PQCLEAN_NTRUHPS4096821_AVX2_owcpa_keypair(unsigned char *pk, void PQCLEAN_NTRUHPS4096821_AVX2_owcpa_keypair(unsigned char *pk,
@ -125,8 +144,8 @@ int PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec(unsigned char *rm,
fail = 0; fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */ /* Check that the unused bits of the last byte of the ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)))); fail |= owcpa_check_ciphertext(ciphertext);
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */ /* We can avoid re-computing r*h + Lift(m) as long as we check that */

2340
crypto_kem/ntruhps4096821/avx2/poly_rq_to_s3.s
View File

File diff suppressed because it is too large Load Diff

77
crypto_kem/ntruhps4096821/clean/owcpa.c
View File

@ -2,40 +2,59 @@
#include "poly.h" #include "poly.h"
#include "sample.h" #include "sample.h"
static int owcpa_check_r(const poly *r) { static int owcpa_check_ciphertext(const unsigned char *ciphertext) {
/* Check that r is in message space. */ /* A ciphertext is log2(q)*(n-1) bits packed into bytes. */
/* Note: Assumes that r has coefficients in {0, 1, ..., q-1} */ /* Check that any unused bits of the final byte are zero. */
int i;
uint64_t t = 0; uint16_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N; i++) { t = ciphertext[NTRU_CIPHERTEXTBYTES - 1];
c = MODQ(r->coeffs[i] + 1); t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)));
t |= c & (NTRU_Q - 4); /* 0 if c is in {0,1,2,3} */
t |= (c + 1) & 0x4; /* 0 if c is in {0,1,2} */ /* We have 0 <= t < 256 */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 15));
} }
t |= MODQ(r->coeffs[NTRU_N - 1]); /* Coefficient n-1 must be zero */
t = (~t + 1); // two's complement static int owcpa_check_r(const poly *r) {
t >>= 63; /* A valid r has coefficients in {0,1,q-1} and has r[N-1] = 0 */
return (int) t; /* Note: We may assume that 0 <= r[i] <= q-1 for all i */
int i;
uint32_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N - 1; i++) {
c = r->coeffs[i];
t |= (c + 1) & (NTRU_Q - 4); /* 0 iff c is in {-1,0,1,2} */
t |= (c + 2) & 4; /* 1 if c = 2, 0 if c is in {-1,0,1} */
}
t |= r->coeffs[NTRU_N - 1]; /* Coefficient n-1 must be zero */
/* We have 0 <= t < 2^16. */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 31));
} }
static int owcpa_check_m(const poly *m) { static int owcpa_check_m(const poly *m) {
/* Check that m is in message space. */ /* Check that m is in message space, i.e. */
/* Note: Assumes that m has coefficients in {0,1,2}. */ /* (1) |{i : m[i] = 1}| = |{i : m[i] = 2}|, and */
/* (2) |{i : m[i] != 0}| = NTRU_WEIGHT. */
/* Note: We may assume that m has coefficients in {0,1,2}. */
int i; int i;
uint64_t t = 0; uint32_t t = 0;
uint16_t p1 = 0; uint16_t ps = 0;
uint16_t m1 = 0; uint16_t ms = 0;
for (i = 0; i < NTRU_N; i++) { for (i = 0; i < NTRU_N; i++) {
p1 += m->coeffs[i] & 0x01; ps += m->coeffs[i] & 1;
m1 += (m->coeffs[i] & 0x02) >> 1; ms += m->coeffs[i] & 2;
} }
/* Need p1 = m1 and p1 + m1 = NTRU_WEIGHT */ t |= ps ^ (ms >> 1); /* 0 if (1) holds */
t |= p1 ^ m1; t |= ms ^ NTRU_WEIGHT; /* 0 if (1) and (2) hold */
t |= (p1 + m1) ^ NTRU_WEIGHT;
t = (~t + 1); // two's complement /* We have 0 <= t < 2^16. */
t >>= 63; /* Return 0 on success (t=0), 1 on failure */
return (int) t; return (int) (1 & ((~t + 1) >> 31));
} }
void PQCLEAN_NTRUHPS4096821_CLEAN_owcpa_keypair(unsigned char *pk, void PQCLEAN_NTRUHPS4096821_CLEAN_owcpa_keypair(unsigned char *pk,
@ -125,8 +144,8 @@ int PQCLEAN_NTRUHPS4096821_CLEAN_owcpa_dec(unsigned char *rm,
fail = 0; fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */ /* Check that the unused bits of the last byte of the ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)))); fail |= owcpa_check_ciphertext(ciphertext);
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */ /* We can avoid re-computing r*h + Lift(m) as long as we check that */

18
crypto_kem/ntruhps4096821/clean/poly_mod.c
View File

@ -30,14 +30,22 @@ void PQCLEAN_NTRUHPS4096821_CLEAN_poly_mod_q_Phi_n(poly *r) {
} }
void PQCLEAN_NTRUHPS4096821_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) { void PQCLEAN_NTRUHPS4096821_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) {
/* NOTE: Assumes input is in [0,Q-1]^N */
/* Produces output in {0,1,2}^N */
int i; int i;
uint16_t flag;
/* Center coeffs around 3Q: [0, Q-1] -> [3Q - Q/2, 3Q + Q/2) */ /* The coefficients of a are stored as non-negative integers. */
/* We must translate to representatives in [-q/2, q/2) before */
/* reduction mod 3. */
for (i = 0; i < NTRU_N; i++) { for (i = 0; i < NTRU_N; i++) {
r->coeffs[i] = ((MODQ(a->coeffs[i]) >> (NTRU_LOGQ - 1)) ^ 3) << NTRU_LOGQ; /* Need an explicit reduction mod q here */
r->coeffs[i] += MODQ(a->coeffs[i]); r->coeffs[i] = MODQ(a->coeffs[i]);
/* flag = 1 if r[i] >= q/2 else 0 */
flag = r->coeffs[i] >> (NTRU_LOGQ - 1);
/* Now we will add (-q) mod 3 if r[i] >= q/2 */
/* Note (-q) mod 3=(-2^k) mod 3=1<<(1-(k&1)) */
r->coeffs[i] += flag << (1 - (NTRU_LOGQ & 1));
} }
PQCLEAN_NTRUHPS4096821_CLEAN_poly_mod_3_Phi_n(r); PQCLEAN_NTRUHPS4096821_CLEAN_poly_mod_3_Phi_n(r);

4
crypto_kem/ntruhrss701/META.yml
View File

@ -23,9 +23,9 @@ auxiliary-submitters:
- Zhenfei Zhang - Zhenfei Zhang
implementations: implementations:
- name: clean - name: clean
version: https://github.com/jschanck/ntru/tree/2d4df948 reference implementation version: https://github.com/jschanck/ntru/tree/b38a346a reference implementation
- name: avx2 - name: avx2
version: https://github.com/jschanck/ntru/tree/2d4df948 avx2 implementation version: https://github.com/jschanck/ntru/tree/b38a346a avx2 implementation
supported_platforms: supported_platforms:
- architecture: x86_64 - architecture: x86_64
operating_systems: operating_systems:

4
crypto_kem/ntruhrss701/avx2/Makefile
View File

@ -2,9 +2,9 @@
LIB=libntruhrss701_avx2.a LIB=libntruhrss701_avx2.a
HEADERS=api.h cmov.h owcpa.h params.h poly.h poly_r2_inv.h sample.h HEADERS=api.h cmov.h owcpa.h params.h poly.h poly_r2_inv.h sample.h
OBJECTS=cmov.o kem.o owcpa.o pack3.o packq.o poly.o poly_r2_inv.o sample.o sample_iid.o \ OBJECTS=cmov.o kem.o owcpa.o pack3.o packq.o poly.o poly_r2_inv.o poly_s3_inv.o sample.o sample_iid.o \
square_1_701_patience.o square_3_701_patience.o square_6_701_patience.o square_12_701_shufbytes.o square_15_701_shufbytes.o square_27_701_shufbytes.o square_42_701_shufbytes.o square_84_701_shufbytes.o square_168_701_shufbytes.o square_336_701_shufbytes.o \ square_1_701_patience.o square_3_701_patience.o square_6_701_patience.o square_12_701_shufbytes.o square_15_701_shufbytes.o square_27_701_shufbytes.o square_42_701_shufbytes.o square_84_701_shufbytes.o square_168_701_shufbytes.o square_336_701_shufbytes.o \
poly_lift.o poly_mod_3_Phi_n.o poly_mod_q_Phi_n.o poly_r2_mul.o poly_rq_mul.o poly_rq_to_s3.o poly_s3_inv.o vec32_sample_iid.o poly_lift.o poly_mod_3_Phi_n.o poly_mod_q_Phi_n.o poly_r2_mul.o poly_rq_mul.o poly_rq_to_s3.o vec32_sample_iid.o
CFLAGS=-O3 -mavx2 -mbmi2 -Wall -Wextra -Wpedantic -Wvla -Werror -Wredundant-decls -Wmissing-prototypes -std=c99 -I../../../common $(EXTRAFLAGS) CFLAGS=-O3 -mavx2 -mbmi2 -Wall -Wextra -Wpedantic -Wvla -Werror -Wredundant-decls -Wmissing-prototypes -std=c99 -I../../../common $(EXTRAFLAGS)

48
crypto_kem/ntruhrss701/avx2/owcpa.c
View File

@ -2,21 +2,37 @@
#include "poly.h" #include "poly.h"
#include "sample.h" #include "sample.h"
static int owcpa_check_r(const poly *r) { static int owcpa_check_ciphertext(const unsigned char *ciphertext) {
/* Check that r is in message space. */ /* A ciphertext is log2(q)*(n-1) bits packed into bytes. */
/* Note: Assumes that r has coefficients in {0, 1, ..., q-1} */ /* Check that any unused bits of the final byte are zero. */
int i;
uint64_t t = 0; uint16_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N; i++) { t = ciphertext[NTRU_CIPHERTEXTBYTES - 1];
c = MODQ(r->coeffs[i] + 1); t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)));
t |= c & (NTRU_Q - 4); /* 0 if c is in {0,1,2,3} */
t |= (c + 1) & 0x4; /* 0 if c is in {0,1,2} */ /* We have 0 <= t < 256 */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 15));
} }
t |= MODQ(r->coeffs[NTRU_N - 1]); /* Coefficient n-1 must be zero */
t = (~t + 1); // two's complement static int owcpa_check_r(const poly *r) {
t >>= 63; /* A valid r has coefficients in {0,1,q-1} and has r[N-1] = 0 */
return (int) t; /* Note: We may assume that 0 <= r[i] <= q-1 for all i */
int i;
uint32_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N - 1; i++) {
c = r->coeffs[i];
t |= (c + 1) & (NTRU_Q - 4); /* 0 iff c is in {-1,0,1,2} */
t |= (c + 2) & 4; /* 1 if c = 2, 0 if c is in {-1,0,1} */
}
t |= r->coeffs[NTRU_N - 1]; /* Coefficient n-1 must be zero */
/* We have 0 <= t < 2^16. */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 31));
} }
@ -108,8 +124,8 @@ int PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec(unsigned char *rm,
fail = 0; fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */ /* Check that the unused bits of the last byte of the ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)))); fail |= owcpa_check_ciphertext(ciphertext);
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */ /* We can avoid re-computing r*h + Lift(m) as long as we check that */

1951
crypto_kem/ntruhrss701/avx2/poly_rq_to_s3.s
View File

File diff suppressed because it is too large Load Diff

569
crypto_kem/ntruhrss701/avx2/poly_s3_inv.c Normal file
View File

@ -0,0 +1,569 @@
#include "poly.h"
#include <immintrin.h>
typedef signed char small;
#define p 700
#define ppad 768
#define numvec 3
typedef __m256i vec256;
/*
This code stores 768-coeff poly as vec256[3].
Order of 256 coefficients in each vec256
is optimized in light of costs of vector instructions:
0,4,...,252 in 64-bit word;
1,5,...,253 in 64-bit word;
2,6,...,254 in 64-bit word;
3,7,...,255 in 64-bit word.
*/
static inline void vec256_frombits(vec256 *v, const small *b) {
int i;
for (i = 0; i < numvec; ++i) {
vec256 b0 = _mm256_loadu_si256((vec256 *) b);
b += 32; /* 0,1,...,31 */
vec256 b1 = _mm256_loadu_si256((vec256 *) b);
b += 32; /* 32,33,... */
vec256 b2 = _mm256_loadu_si256((vec256 *) b);
b += 32;
vec256 b3 = _mm256_loadu_si256((vec256 *) b);
b += 32;
vec256 b4 = _mm256_loadu_si256((vec256 *) b);
b += 32;
vec256 b5 = _mm256_loadu_si256((vec256 *) b);
b += 32;
vec256 b6 = _mm256_loadu_si256((vec256 *) b);
b += 32;
vec256 b7 = _mm256_loadu_si256((vec256 *) b);
b += 32;
vec256 c0 = _mm256_unpacklo_epi32(b0, b1); /* 0 1 2 3 32 33 34 35 4 5 6 7 36 37 38 39 ... 55 */
vec256 c1 = _mm256_unpackhi_epi32(b0, b1); /* 8 9 10 11 40 41 42 43 ... 63 */
vec256 c2 = _mm256_unpacklo_epi32(b2, b3);
vec256 c3 = _mm256_unpackhi_epi32(b2, b3);
vec256 c4 = _mm256_unpacklo_epi32(b4, b5);
vec256 c5 = _mm256_unpackhi_epi32(b4, b5);
vec256 c6 = _mm256_unpacklo_epi32(b6, b7);
vec256 c7 = _mm256_unpackhi_epi32(b6, b7);
vec256 d0 = c0 | _mm256_slli_epi32(c1, 2); /* 0 8, 1 9, 2 10, 3 11, 32 40, 33 41, ..., 55 63 */
vec256 d2 = c2 | _mm256_slli_epi32(c3, 2);
vec256 d4 = c4 | _mm256_slli_epi32(c5, 2);
vec256 d6 = c6 | _mm256_slli_epi32(c7, 2);
vec256 e0 = _mm256_unpacklo_epi64(d0, d2);
vec256 e2 = _mm256_unpackhi_epi64(d0, d2);
vec256 e4 = _mm256_unpacklo_epi64(d4, d6);
vec256 e6 = _mm256_unpackhi_epi64(d4, d6);
vec256 f0 = e0 | _mm256_slli_epi32(e2, 1);
vec256 f4 = e4 | _mm256_slli_epi32(e6, 1);
vec256 g0 = _mm256_permute2x128_si256(f0, f4, 0x20);
vec256 g4 = _mm256_permute2x128_si256(f0, f4, 0x31);
vec256 h = g0 | _mm256_slli_epi32(g4, 4);
#define TRANSPOSE _mm256_set_epi8( 31,27,23,19, 30,26,22,18, 29,25,21,17, 28,24,20,16, 15,11,7,3, 14,10,6,2, 13,9,5,1, 12,8,4,0 )
h = _mm256_shuffle_epi8(h, TRANSPOSE);
h = _mm256_permute4x64_epi64(h, 0xd8);
h = _mm256_shuffle_epi32(h, 0xd8);
*v++ = h;
}
}
static inline void vec256_tobits(const vec256 *v, small *b) {
int i;
for (i = 0; i < numvec; ++i) {
vec256 h = *v++;
h = _mm256_shuffle_epi32(h, 0xd8);
h = _mm256_permute4x64_epi64(h, 0xd8);
h = _mm256_shuffle_epi8(h, TRANSPOSE);
vec256 g0 = h & _mm256_set1_epi8(15);
vec256 g4 = _mm256_srli_epi32(h, 4) & _mm256_set1_epi8(15);
vec256 f0 = _mm256_permute2x128_si256(g0, g4, 0x20);
vec256 f4 = _mm256_permute2x128_si256(g0, g4, 0x31);
vec256 e0 = f0 & _mm256_set1_epi8(5);
vec256 e2 = _mm256_srli_epi32(f0, 1) & _mm256_set1_epi8(5);
vec256 e4 = f4 & _mm256_set1_epi8(5);
vec256 e6 = _mm256_srli_epi32(f4, 1) & _mm256_set1_epi8(5);
vec256 d0 = _mm256_unpacklo_epi32(e0, e2);
vec256 d2 = _mm256_unpackhi_epi32(e0, e2);
vec256 d4 = _mm256_unpacklo_epi32(e4, e6);
vec256 d6 = _mm256_unpackhi_epi32(e4, e6);
vec256 c0 = d0 & _mm256_set1_epi8(1);
vec256 c1 = _mm256_srli_epi32(d0, 2) & _mm256_set1_epi8(1);
vec256 c2 = d2 & _mm256_set1_epi8(1);
vec256 c3 = _mm256_srli_epi32(d2, 2) & _mm256_set1_epi8(1);
vec256 c4 = d4 & _mm256_set1_epi8(1);
vec256 c5 = _mm256_srli_epi32(d4, 2) & _mm256_set1_epi8(1);
vec256 c6 = d6 & _mm256_set1_epi8(1);
vec256 c7 = _mm256_srli_epi32(d6, 2) & _mm256_set1_epi8(1);
vec256 b0 = _mm256_unpacklo_epi64(c0, c1);
vec256 b1 = _mm256_unpackhi_epi64(c0, c1);
vec256 b2 = _mm256_unpacklo_epi64(c2, c3);
vec256 b3 = _mm256_unpackhi_epi64(c2, c3);
vec256 b4 = _mm256_unpacklo_epi64(c4, c5);
vec256 b5 = _mm256_unpackhi_epi64(c4, c5);
vec256 b6 = _mm256_unpacklo_epi64(c6, c7);
vec256 b7 = _mm256_unpackhi_epi64(c6, c7);
_mm256_storeu_si256((vec256 *) b, b0);
b += 32;
_mm256_storeu_si256((vec256 *) b, b1);
b += 32;
_mm256_storeu_si256((vec256 *) b, b2);
b += 32;
_mm256_storeu_si256((vec256 *) b, b3);
b += 32;
_mm256_storeu_si256((vec256 *) b, b4);
b += 32;
_mm256_storeu_si256((vec256 *) b, b5);
b += 32;
_mm256_storeu_si256((vec256 *) b, b6);
b += 32;
_mm256_storeu_si256((vec256 *) b, b7);
b += 32;
}
}
static void vec256_init(vec256 *G0, vec256 *G1, const small *s) {
int i;
small srev[ppad + (ppad - p)];
small si;
small g0[ppad];
small g1[ppad];
for (i = 0; i < p; ++i) {
srev[ppad - 1 - i] = s[i];
}
for (i = 0; i < ppad - p; ++i) {
srev[i] = 0;
}
for (i = p; i < ppad; ++i) {
srev[i + ppad - p] = 0;
}
for (i = 0; i < ppad; ++i) {
si = srev[i + ppad - p];
g0[i] = si & 1;
g1[i] = (si >> 1) & g0[i];
}
vec256_frombits(G0, g0);
vec256_frombits(G1, g1);
}
static void vec256_final(small *out, const vec256 *V0, const vec256 *V1) {
int i;
small v0[ppad];
small v1[ppad];
small v[ppad];
small vrev[ppad + (ppad - p)];
vec256_tobits(V0, v0);
vec256_tobits(V1, v1);
for (i = 0; i < ppad; ++i) {
v[i] = v0[i] + 2 * v1[i] - 4 * (v0[i] & v1[i]);
}
for (i = 0; i < ppad; ++i) {
vrev[i] = v[ppad - 1 - i];
}
for (i = ppad; i < ppad + (ppad - p); ++i) {
vrev[i] = 0;
}
for (i = 0; i < p; ++i) {
out[i] = vrev[i + ppad - p];
}
}
static inline int negative_mask(int x) {
return x >> 31;
}
static inline void vec256_swap(vec256 *f, vec256 *g, int len, vec256 mask) {
vec256 flip;
int i;
for (i = 0; i < len; ++i) {
flip = mask & (f[i] ^ g[i]);
f[i] ^= flip;
g[i] ^= flip;
}
}
static inline void vec256_scale(vec256 *f0, vec256 *f1, const vec256 c0, const vec256 c1) {
int i;
for (i = 0; i < numvec; ++i) {
vec256 f0i = f0[i];
vec256 f1i = f1[i];
f0i &= c0;
f1i ^= c1;
f1i &= f0i;
f0[i] = f0i;
f1[i] = f1i;
}
}
static inline void vec256_eliminate(vec256 *f0, vec256 *f1, vec256 *g0, vec256 *g1, int len, const vec256 c0, const vec256 c1) {
int i;
for (i = 0; i < len; ++i) {
vec256 f0i = f0[i];
vec256 f1i = f1[i];
vec256 g0i = g0[i];
vec256 g1i = g1[i];
vec256 t;
f0i &= c0;
f1i ^= c1;
f1i &= f0i;
t = g0i ^ f0i;
g0[i] = t | (g1i ^ f1i);
g1[i] = (g1i ^ f0i) & (f1i ^ t);
}
}
static inline int vec256_bit0mask(vec256 *f) {
return -(_mm_cvtsi128_si32(_mm256_castsi256_si128(f[0])) & 1);
}
static inline void vec256_divx_1(vec256 *f) {
vec256 f0 = f[0];
unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0));
low0 = low0 >> 1;
f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3);
f[0] = _mm256_permute4x64_epi64(f0, 0x39);
}
static inline void vec256_divx_2(vec256 *f) {
vec256 f0 = f[0];
vec256 f1 = f[1];
unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0));
unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1));
low0 = (low0 >> 1) | (low1 << 63);
low1 = low1 >> 1;
f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3);
f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3);
f[0] = _mm256_permute4x64_epi64(f0, 0x39);
f[1] = _mm256_permute4x64_epi64(f1, 0x39);
}
static inline void vec256_divx_3(vec256 *f) {
vec256 f0 = f[0];
vec256 f1 = f[1];
vec256 f2 = f[2];
unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0));
unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1));
unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2));
low0 = (low0 >> 1) | (low1 << 63);
low1 = (low1 >> 1) | (low2 << 63);
low2 = low2 >> 1;
f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3);
f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3);
f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3);
f[0] = _mm256_permute4x64_epi64(f0, 0x39);
f[1] = _mm256_permute4x64_epi64(f1, 0x39);
f[2] = _mm256_permute4x64_epi64(f2, 0x39);
}
static inline void vec256_timesx_1(vec256 *f) {
vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93);
unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0));
low0 = low0 << 1;
f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3);
f[0] = f0;
}
static inline void vec256_timesx_2(vec256 *f) {
vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93);
vec256 f1 = _mm256_permute4x64_epi64(f[1], 0x93);
unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0));
unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1));
low1 = (low1 << 1) | (low0 >> 63);
low0 = low0 << 1;
f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3);
f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3);
f[0] = f0;
f[1] = f1;
}
static inline void vec256_timesx_3(vec256 *f) {
vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93);
vec256 f1 = _mm256_permute4x64_epi64(f[1], 0x93);
vec256 f2 = _mm256_permute4x64_epi64(f[2], 0x93);
unsigned long long low0 = *(unsigned long long *) &f0;
unsigned long long low1 = *(unsigned long long *) &f1;
unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2));
low2 = (low2 << 1) | (low1 >> 63);
low1 = (low1 << 1) | (low0 >> 63);
low0 = low0 << 1;
*(unsigned long long *) &f0 = low0;
*(unsigned long long *) &f1 = low1;
f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3);
f[0] = f0;
f[1] = f1;
f[2] = f2;
}
static int __poly_S3_inv(unsigned char *outbytes, const unsigned char *inbytes) {
small *out = (void *) outbytes;
small *in = (void *) inbytes;
vec256 F0[numvec];
vec256 F1[numvec];
vec256 G0[numvec];
vec256 G1[numvec];
vec256 V0[numvec];
vec256 V1[numvec];
vec256 R0[numvec];
vec256 R1[numvec];
vec256 c0vec, c1vec;
int loop;
int c0, c1;
int minusdelta = -1;
int swapmask;
vec256 swapvec;
vec256_init(G0, G1, in);
F0[0] = _mm256_set_epi32(-1, -1, -1, -1, -1, -1, -1, -1);
F0[1] = _mm256_set_epi32(-1, -1, -1, -1, -1, -1, -1, -1);
F0[2] = _mm256_set_epi32(32767, -1, 32767, -1, 32767, -1, 65535, -1);
F1[0] = _mm256_set1_epi32(0);
F1[1] = _mm256_set1_epi32(0);
F1[2] = _mm256_set1_epi32(0);
V0[0] = _mm256_set1_epi32(0);
V1[0] = _mm256_set1_epi32(0);
V0[1] = _mm256_set1_epi32(0);
V1[1] = _mm256_set1_epi32(0);
V0[2] = _mm256_set1_epi32(0);
V1[2] = _mm256_set1_epi32(0);
R0[0] = _mm256_set_epi32(0, 0, 0, 0, 0, 0, 0, 1);
R1[0] = _mm256_set1_epi32(0);
R0[1] = _mm256_set1_epi32(0);
R1[1] = _mm256_set1_epi32(0);
R0[2] = _mm256_set1_epi32(0);
R1[2] = _mm256_set1_epi32(0);
for (loop = 256; loop > 0; --loop) {
vec256_timesx_1(V0);
vec256_timesx_1(V1);
swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0);
c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0);
c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1);
c1 &= c0;
minusdelta ^= swapmask & (minusdelta ^ -minusdelta);
minusdelta -= 1;
swapvec = _mm256_set1_epi32(swapmask);
vec256_swap(F0, G0, 3, swapvec);
vec256_swap(F1, G1, 3, swapvec);
c0vec = _mm256_set1_epi32(c0);
c1vec = _mm256_set1_epi32(c1);
vec256_eliminate(F0, F1, G0, G1, 3, c0vec, c1vec);
vec256_divx_3(G0);
vec256_divx_3(G1);
vec256_swap(V0, R0, 1, swapvec);
vec256_swap(V1, R1, 1, swapvec);
vec256_eliminate(V0, V1, R0, R1, 1, c0vec, c1vec);
}
for (loop = 256; loop > 0; --loop) {
vec256_timesx_2(V0);
vec256_timesx_2(V1);
swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0);
c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0);
c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1);
c1 &= c0;
minusdelta ^= swapmask & (minusdelta ^ -minusdelta);
minusdelta -= 1;
swapvec = _mm256_set1_epi32(swapmask);
vec256_swap(F0, G0, 3, swapvec);
vec256_swap(F1, G1, 3, swapvec);
c0vec = _mm256_set1_epi32(c0);
c1vec = _mm256_set1_epi32(c1);
vec256_eliminate(F0, F1, G0, G1, 3, c0vec, c1vec);
vec256_divx_3(G0);
vec256_divx_3(G1);
vec256_swap(V0, R0, 2, swapvec);
vec256_swap(V1, R1, 2, swapvec);
vec256_eliminate(V0, V1, R0, R1, 2, c0vec, c1vec);
}
for (loop = 375; loop > 0; --loop) {
vec256_timesx_3(V0);
vec256_timesx_3(V1);
swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0);
c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0);
c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1);
c1 &= c0;
minusdelta ^= swapmask & (minusdelta ^ -minusdelta);
minusdelta -= 1;
swapvec = _mm256_set1_epi32(swapmask);
vec256_swap(F0, G0, 3, swapvec);
vec256_swap(F1, G1, 3, swapvec);
c0vec = _mm256_set1_epi32(c0);
c1vec = _mm256_set1_epi32(c1);
vec256_eliminate(F0, F1, G0, G1, 3, c0vec, c1vec);
vec256_divx_3(G0);
vec256_divx_3(G1);
vec256_swap(V0, R0, 3, swapvec);
vec256_swap(V1, R1, 3, swapvec);
vec256_eliminate(V0, V1, R0, R1, 3, c0vec, c1vec);
}
for (loop = 256; loop > 0; --loop) {
vec256_timesx_3(V0);
vec256_timesx_3(V1);
swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0);
c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0);
c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1);
c1 &= c0;
minusdelta ^= swapmask & (minusdelta ^ -minusdelta);
minusdelta -= 1;
swapvec = _mm256_set1_epi32(swapmask);
vec256_swap(F0, G0, 2, swapvec);
vec256_swap(F1, G1, 2, swapvec);
c0vec = _mm256_set1_epi32(c0);
c1vec = _mm256_set1_epi32(c1);
vec256_eliminate(F0, F1, G0, G1, 2, c0vec, c1vec);
vec256_divx_2(G0);
vec256_divx_2(G1);
vec256_swap(V0, R0, 3, swapvec);
vec256_swap(V1, R1, 3, swapvec);
vec256_eliminate(V0, V1, R0, R1, 3, c0vec, c1vec);
}
for (loop = 256; loop > 0; --loop) {
vec256_timesx_3(V0);
vec256_timesx_3(V1);
swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0);
c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0);
c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1);
c1 &= c0;
minusdelta ^= swapmask & (minusdelta ^ -minusdelta);
minusdelta -= 1;
swapvec = _mm256_set1_epi32(swapmask);
vec256_swap(F0, G0, 1, swapvec);
vec256_swap(F1, G1, 1, swapvec);
c0vec = _mm256_set1_epi32(c0);
c1vec = _mm256_set1_epi32(c1);
vec256_eliminate(F0, F1, G0, G1, 1, c0vec, c1vec);
vec256_divx_1(G0);
vec256_divx_1(G1);
vec256_swap(V0, R0, 3, swapvec);
vec256_swap(V1, R1, 3, swapvec);
vec256_eliminate(V0, V1, R0, R1, 3, c0vec, c1vec);
}
c0vec = _mm256_set1_epi32(vec256_bit0mask(F0));
c1vec = _mm256_set1_epi32(vec256_bit0mask(F1));
vec256_scale(V0, V1, c0vec, c1vec);
vec256_final(out, V0, V1);
out[p] = negative_mask(minusdelta);
return 0;
}
// This code is based on crypto_core/invhrss701/faster from SUPERCOP. The code was written as a case study
// for the paper "Fast constant-time gcd computation and modular inversion" by Daniel J. Bernstein and Bo-Yin Yang.
void PQCLEAN_NTRUHRSS701_AVX2_poly_S3_inv(poly *r_out, const poly *a) {
const unsigned char *in = (void *) a;
unsigned char *out = (void *) r_out;
small input[ppad];
small output[ppad];
int i;
/* XXX: obviously input/output format should be packed into bytes */
for (i = 0; i < p; ++i) {
small x = in[2 * i] & 3; /* 0 1 2 3 */
x += 1; /* 0 1 2 3 4 5 6, offset by 1 */
x &= (x - 3) >> 5; /* 0 1 2, offset by 1 */
input[i] = x - 1;
}
/* XXX: merge with vec256_init */
__poly_S3_inv((unsigned char *)output, (unsigned char *)input);
for (i = 0; i < p; ++i) {
out[2 * i] = (3 & output[i]) ^ ((3 & output[i]) >> 1);
out[2 * i + 1] = 0;
}
}

5449
crypto_kem/ntruhrss701/avx2/poly_s3_inv.s
View File

File diff suppressed because it is too large Load Diff

48
crypto_kem/ntruhrss701/clean/owcpa.c
View File

@ -2,21 +2,37 @@
#include "poly.h" #include "poly.h"
#include "sample.h" #include "sample.h"
static int owcpa_check_r(const poly *r) { static int owcpa_check_ciphertext(const unsigned char *ciphertext) {
/* Check that r is in message space. */ /* A ciphertext is log2(q)*(n-1) bits packed into bytes. */
/* Note: Assumes that r has coefficients in {0, 1, ..., q-1} */ /* Check that any unused bits of the final byte are zero. */
int i;
uint64_t t = 0; uint16_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N; i++) { t = ciphertext[NTRU_CIPHERTEXTBYTES - 1];
c = MODQ(r->coeffs[i] + 1); t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)));
t |= c & (NTRU_Q - 4); /* 0 if c is in {0,1,2,3} */
t |= (c + 1) & 0x4; /* 0 if c is in {0,1,2} */ /* We have 0 <= t < 256 */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 15));
} }
t |= MODQ(r->coeffs[NTRU_N - 1]); /* Coefficient n-1 must be zero */
t = (~t + 1); // two's complement static int owcpa_check_r(const poly *r) {
t >>= 63; /* A valid r has coefficients in {0,1,q-1} and has r[N-1] = 0 */
return (int) t; /* Note: We may assume that 0 <= r[i] <= q-1 for all i */
int i;
uint32_t t = 0;
uint16_t c;
for (i = 0; i < NTRU_N - 1; i++) {
c = r->coeffs[i];
t |= (c + 1) & (NTRU_Q - 4); /* 0 iff c is in {-1,0,1,2} */
t |= (c + 2) & 4; /* 1 if c = 2, 0 if c is in {-1,0,1} */
}
t |= r->coeffs[NTRU_N - 1]; /* Coefficient n-1 must be zero */
/* We have 0 <= t < 2^16. */
/* Return 0 on success (t=0), 1 on failure */
return (int) (1 & ((~t + 1) >> 31));
} }
@ -108,8 +124,8 @@ int PQCLEAN_NTRUHRSS701_CLEAN_owcpa_dec(unsigned char *rm,
fail = 0; fail = 0;
/* Check that unused bits of last byte of ciphertext are zero */ /* Check that the unused bits of the last byte of the ciphertext are zero */
fail |= ciphertext[NTRU_CIPHERTEXTBYTES - 1] & (0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG)))); fail |= owcpa_check_ciphertext(ciphertext);
/* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */
/* We can avoid re-computing r*h + Lift(m) as long as we check that */ /* We can avoid re-computing r*h + Lift(m) as long as we check that */

18
crypto_kem/ntruhrss701/clean/poly_mod.c
View File

@ -30,14 +30,22 @@ void PQCLEAN_NTRUHRSS701_CLEAN_poly_mod_q_Phi_n(poly *r) {
} }
void PQCLEAN_NTRUHRSS701_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) { void PQCLEAN_NTRUHRSS701_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) {
/* NOTE: Assumes input is in [0,Q-1]^N */
/* Produces output in {0,1,2}^N */
int i; int i;
uint16_t flag;
/* Center coeffs around 3Q: [0, Q-1] -> [3Q - Q/2, 3Q + Q/2) */ /* The coefficients of a are stored as non-negative integers. */
/* We must translate to representatives in [-q/2, q/2) before */
/* reduction mod 3. */
for (i = 0; i < NTRU_N; i++) { for (i = 0; i < NTRU_N; i++) {
r->coeffs[i] = ((MODQ(a->coeffs[i]) >> (NTRU_LOGQ - 1)) ^ 3) << NTRU_LOGQ; /* Need an explicit reduction mod q here */
r->coeffs[i] += MODQ(a->coeffs[i]); r->coeffs[i] = MODQ(a->coeffs[i]);
/* flag = 1 if r[i] >= q/2 else 0 */
flag = r->coeffs[i] >> (NTRU_LOGQ - 1);
/* Now we will add (-q) mod 3 if r[i] >= q/2 */
/* Note (-q) mod 3=(-2^k) mod 3=1<<(1-(k&1)) */
r->coeffs[i] += flag << (1 - (NTRU_LOGQ & 1));
} }
PQCLEAN_NTRUHRSS701_CLEAN_poly_mod_3_Phi_n(r); PQCLEAN_NTRUHRSS701_CLEAN_poly_mod_3_Phi_n(r);