diff --git a/crypto_kem/ledakemlt12/clean/H_Q_matrices_generation.h b/crypto_kem/ledakemlt12/clean/H_Q_matrices_generation.h index 11509bf4..8274dcd9 100644 --- a/crypto_kem/ledakemlt12/clean/H_Q_matrices_generation.h +++ b/crypto_kem/ledakemlt12/clean/H_Q_matrices_generation.h @@ -1,17 +1,11 @@ #ifndef H_Q_MATRICES_GENERATION_H #define H_Q_MATRICES_GENERATION_H -#include "gf2x_limbs.h" +#include "gf2x_arith.h" #include "qc_ldpc_parameters.h" #include "rng.h" -void PQCLEAN_LEDAKEMLT12_CLEAN_generateHPosOnes_HtrPosOnes( - POSITION_T HPosOnes[N0][DV], - POSITION_T HtrPosOnes[N0][DV], - AES_XOF_struct *niederreiter_keys_expander); - -void PQCLEAN_LEDAKEMLT12_CLEAN_generateQsparse( - POSITION_T pos_ones[N0][M], - AES_XOF_struct *niederreiter_keys_expander); +void PQCLEAN_LEDAKEMLT12_CLEAN_generateHPosOnes_HtrPosOnes(POSITION_T HPosOnes[N0][DV], POSITION_T HtrPosOnes[N0][DV], AES_XOF_struct *niederreiter_keys_expander); +void PQCLEAN_LEDAKEMLT12_CLEAN_generateQsparse(POSITION_T pos_ones[N0][M], AES_XOF_struct *niederreiter_keys_expander); #endif diff --git a/crypto_kem/ledakemlt12/clean/Makefile b/crypto_kem/ledakemlt12/clean/Makefile index 08c019ee..6d6fa541 100644 --- a/crypto_kem/ledakemlt12/clean/Makefile +++ b/crypto_kem/ledakemlt12/clean/Makefile @@ -2,7 +2,7 @@ LIB=libledakemlt12_clean.a HEADERS=api.h bf_decoding.h dfr_test.h gf2x_arith_mod_xPplusOne.h \ - gf2x_arith.h gf2x_limbs.h H_Q_matrices_generation.h \ + gf2x_arith.h H_Q_matrices_generation.h \ niederreiter.h qc_ldpc_parameters.h rng.h OBJECTS=bf_decoding.o dfr_test.o gf2x_arith_mod_xPplusOne.o \ diff --git a/crypto_kem/ledakemlt12/clean/bf_decoding.h b/crypto_kem/ledakemlt12/clean/bf_decoding.h index 927a5e71..18a7dd8b 100644 --- a/crypto_kem/ledakemlt12/clean/bf_decoding.h +++ b/crypto_kem/ledakemlt12/clean/bf_decoding.h @@ -1,7 +1,7 @@ #ifndef BF_DECODING_H #define BF_DECODING_H -#include "gf2x_limbs.h" +#include "gf2x_arith.h" #include "qc_ldpc_parameters.h" /* Definitions for DFR level 2^-SL with SL=128 */ @@ -11,7 +11,7 @@ int PQCLEAN_LEDAKEMLT12_CLEAN_bf_decoding(DIGIT err[], const POSITION_T HtrPosOnes[N0][DV], - const POSITION_T QtrPosOnes[N0][M], // N0 vectors containing exp.s of Qtr ones + const POSITION_T QtrPosOnes[N0][M], DIGIT privateSyndrome[]); #endif diff --git a/crypto_kem/ledakemlt12/clean/gf2x_arith.h b/crypto_kem/ledakemlt12/clean/gf2x_arith.h index b9a512a9..032dfd57 100644 --- a/crypto_kem/ledakemlt12/clean/gf2x_arith.h +++ b/crypto_kem/ledakemlt12/clean/gf2x_arith.h @@ -1,7 +1,8 @@ #ifndef GF2X_ARITH_H #define GF2X_ARITH_H -#include "gf2x_limbs.h" +#include +#include /* * Elements of GF(2)[x] are stored in compact dense binary form. @@ -42,9 +43,12 @@ * position[A_{0}] == n-1 */ +typedef uint64_t DIGIT; +#define DIGIT_SIZE_B (8) +#define DIGIT_SIZE_b (DIGIT_SIZE_B << 3) +#define POSITION_T uint32_t #define GF2X_MUL PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mul_comb -// #define GF2X_MUL gf2x_mul_comb static inline void gf2x_add(DIGIT Res[], const DIGIT A[], const DIGIT B[], size_t nr) { for (size_t i = 0; i < nr; i++) { @@ -52,13 +56,8 @@ static inline void gf2x_add(DIGIT Res[], const DIGIT A[], const DIGIT B[], size_ } } -/* PRE: MAX ALLOWED ROTATION AMOUNT : DIGIT_SIZE_b */ void PQCLEAN_LEDAKEMLT12_CLEAN_right_bit_shift_n(size_t length, DIGIT in[], unsigned int amount); - -/* PRE: MAX ALLOWED ROTATION AMOUNT : DIGIT_SIZE_b */ void PQCLEAN_LEDAKEMLT12_CLEAN_left_bit_shift_n(size_t length, DIGIT in[], unsigned int amount); - void GF2X_MUL(int nr, DIGIT Res[], int na, const DIGIT A[], int nb, const DIGIT B[]); - #endif diff --git a/crypto_kem/ledakemlt12/clean/gf2x_arith_mod_xPplusOne.c b/crypto_kem/ledakemlt12/clean/gf2x_arith_mod_xPplusOne.c index a5adb29e..e4b0557a 100644 --- a/crypto_kem/ledakemlt12/clean/gf2x_arith_mod_xPplusOne.c +++ b/crypto_kem/ledakemlt12/clean/gf2x_arith_mod_xPplusOne.c @@ -7,7 +7,7 @@ static void gf2x_mod(DIGIT out[], const DIGIT in[]) { - int i, j, posTrailingBit, maskOffset; + int i, j, posTrailingBit, maskOffset, to_copy; DIGIT mask, aux[2 * NUM_DIGITS_GF2X_ELEMENT]; memcpy(aux, in, 2 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); @@ -46,7 +46,7 @@ static void gf2x_mod(DIGIT out[], const DIGIT in[]) { } } - int to_copy = (2 * NUM_DIGITS_GF2X_ELEMENT > NUM_DIGITS_GF2X_ELEMENT) ? NUM_DIGITS_GF2X_ELEMENT : 2 * NUM_DIGITS_GF2X_ELEMENT; + to_copy = (2 * NUM_DIGITS_GF2X_ELEMENT > NUM_DIGITS_GF2X_ELEMENT) ? NUM_DIGITS_GF2X_ELEMENT : 2 * NUM_DIGITS_GF2X_ELEMENT; for (i = 0; i < to_copy; i++) { out[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = aux[2 * NUM_DIGITS_GF2X_ELEMENT - 1 - i]; @@ -93,31 +93,19 @@ static void left_bit_shift_wide_n(const int length, DIGIT in[], unsigned int amo PQCLEAN_LEDAKEMLT12_CLEAN_left_bit_shift_n(length, in, amount % DIGIT_SIZE_b); } -static uint8_t byte_reverse_with_64bitDIGIT(uint8_t b) { - b = (uint8_t)((b * 0x0202020202ULL & 0x010884422010ULL) % 1023); - return b; -} - -/* https://stackoverflow.com/questions/2182002/convert-big-endian-to-little-endian-in-c-without-using-provided-func */ -static uint64_t swap_uint64( uint64_t val ) { - val = ((val << 8) & 0xFF00FF00FF00FF00ULL ) | ((val >> 8) & 0x00FF00FF00FF00FFULL ); - val = ((val << 16) & 0xFFFF0000FFFF0000ULL ) | ((val >> 16) & 0x0000FFFF0000FFFFULL ); - return (val << 32) | (val >> 32); -} - -static DIGIT reverse_digit(const DIGIT b) { - int i; - union toReverse_t { - uint8_t inByte[DIGIT_SIZE_B]; - DIGIT digitValue; - } toReverse; - - toReverse.digitValue = b; - for (i = 0; i < DIGIT_SIZE_B; i++) { - toReverse.inByte[i] = byte_reverse_with_64bitDIGIT(toReverse.inByte[i]); - } - - return swap_uint64(toReverse.digitValue); +/* Hackers delight, reverses a uint64_t */ +static DIGIT reverse_digit(DIGIT x) { + uint64_t t; + x = (x << 31) | (x >> 33); + t = (x ^ (x >> 20)) & 0x00000FFF800007FFLL; + x = (t | (t << 20)) ^ x; + t = (x ^ (x >> 8)) & 0x00F8000F80700807LL; + x = (t | (t << 8)) ^ x; + t = (x ^ (x >> 4)) & 0x0808708080807008LL; + x = (t | (t << 4)) ^ x; + t = (x ^ (x >> 2)) & 0x1111111111111111LL; + x = (t | (t << 2)) ^ x; + return x; } void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_transpose_in_place(DIGIT A[]) { @@ -137,11 +125,11 @@ void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_transpose_in_place(DIGIT A[]) { A[i] = rev2; A[NUM_DIGITS_GF2X_ELEMENT - 1 - i] = rev1; } - /* + + if (NUM_DIGITS_GF2X_ELEMENT % 2 == 1) { A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]); - }*/ - A[NUM_DIGITS_GF2X_ELEMENT / 2] = reverse_digit(A[NUM_DIGITS_GF2X_ELEMENT / 2]); + } if (slack_bits_amount) { PQCLEAN_LEDAKEMLT12_CLEAN_right_bit_shift_n(NUM_DIGITS_GF2X_ELEMENT, A, slack_bits_amount); @@ -220,7 +208,6 @@ static void gf2x_swap(const int length, * (Chapter 11 -- Algorithm 11.44 -- pag 223) * */ - int PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]) { /* in^{-1} mod x^P-1 */ int i; @@ -533,3 +520,12 @@ void PQCLEAN_LEDAKEMLT12_CLEAN_rand_circulant_blocks_sequence( } } + +void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly) { + size_t i, j; + for (i = 0; i < NUM_DIGITS_GF2X_ELEMENT; i++) { + for (j = 0; j < DIGIT_SIZE_B; j++) { + bytes[i * DIGIT_SIZE_B + j] = (uint8_t) ((poly[i] >> (8 * j)) & 0xFF); + } + } +} diff --git a/crypto_kem/ledakemlt12/clean/gf2x_arith_mod_xPplusOne.h b/crypto_kem/ledakemlt12/clean/gf2x_arith_mod_xPplusOne.h index f41eb8ef..af42422f 100644 --- a/crypto_kem/ledakemlt12/clean/gf2x_arith_mod_xPplusOne.h +++ b/crypto_kem/ledakemlt12/clean/gf2x_arith_mod_xPplusOne.h @@ -1,23 +1,19 @@ #ifndef GF2X_ARITH_MOD_XPLUSONE_H #define GF2X_ARITH_MOD_XPLUSONE_H -#include "gf2x_limbs.h" #include "qc_ldpc_parameters.h" #include "gf2x_arith.h" #include "rng.h" -#define NUM_BITS_GF2X_ELEMENT (P) // 52147 -#define NUM_DIGITS_GF2X_ELEMENT ((P+DIGIT_SIZE_b-1)/DIGIT_SIZE_b) // 815 -#define MSb_POSITION_IN_MSB_DIGIT_OF_ELEMENT ( (P % DIGIT_SIZE_b) ? (P % DIGIT_SIZE_b)-1 : DIGIT_SIZE_b-1 ) - -#define NUM_BITS_GF2X_MODULUS (P+1) -#define NUM_DIGITS_GF2X_MODULUS ((P+1+DIGIT_SIZE_b-1)/DIGIT_SIZE_b) -#define MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS (P-DIGIT_SIZE_b*(NUM_DIGITS_GF2X_MODULUS-1)) - -#define INVALID_POS_VALUE (P) - -#define P_BITS (16) // log_2(p) = 15.6703 +#define NUM_BITS_GF2X_ELEMENT (P) // 52147 +#define NUM_DIGITS_GF2X_ELEMENT ((P+DIGIT_SIZE_b-1)/DIGIT_SIZE_b) +#define MSb_POSITION_IN_MSB_DIGIT_OF_ELEMENT ((P % DIGIT_SIZE_b) ? (P % DIGIT_SIZE_b)-1 : DIGIT_SIZE_b-1) +#define NUM_BITS_GF2X_MODULUS (P+1) +#define NUM_DIGITS_GF2X_MODULUS ((P+1+DIGIT_SIZE_b-1)/DIGIT_SIZE_b) +#define MSb_POSITION_IN_MSB_DIGIT_OF_MODULUS (P-DIGIT_SIZE_b*(NUM_DIGITS_GF2X_MODULUS-1)) +#define INVALID_POS_VALUE (P) +#define P_BITS (16) // log_2(p) = 15.6703 static inline void gf2x_copy(DIGIT dest[], const DIGIT in[]) { @@ -43,8 +39,7 @@ static inline void gf2x_set_coeff(DIGIT poly[], unsigned int exponent, DIGIT val /* clear given coefficient */ DIGIT mask = ~( ((DIGIT) 1) << (DIGIT_SIZE_b - 1 - inDigitIdx)); poly[digitIdx] = poly[digitIdx] & mask; - poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << - (DIGIT_SIZE_b - 1 - inDigitIdx)); + poly[digitIdx] = poly[digitIdx] | (( value & ((DIGIT) 1)) << (DIGIT_SIZE_b - 1 - inDigitIdx)); } /* toggles (flips) the coefficient of the x^exponent term as the LSB of a digit */ @@ -58,8 +53,8 @@ static inline void gf2x_toggle_coeff(DIGIT poly[], unsigned int exponent) { poly[digitIdx] = poly[digitIdx] ^ mask; } - -/* population count for an unsigned 64-bit integer */ +/* population count for an unsigned 64-bit integer + Source: Hacker's delight, p.66 */ static int popcount_uint64t(uint64_t x) { x -= (x >> 1) & 0x5555555555555555; x = (x & 0x3333333333333333) + ((x >> 2) & 0x3333333333333333); @@ -80,42 +75,6 @@ static inline void gf2x_mod_add(DIGIT Res[], const DIGIT A[], const DIGIT B[]) { gf2x_add(Res, A, B, NUM_DIGITS_GF2X_ELEMENT); } -void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); - -int PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); - -/* in place bit-transp. of a(x) % x^P+1, e.g.: a3 a2 a1 a0 --> a1 a2 a3 a0 */ -void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_transpose_in_place(DIGIT A[]); - -void PQCLEAN_LEDAKEMLT12_CLEAN_rand_circulant_sparse_block( - POSITION_T *pos_ones, - int countOnes, - AES_XOF_struct *seed_expander_ctx); - -void PQCLEAN_LEDAKEMLT12_CLEAN_rand_circulant_blocks_sequence( - DIGIT sequence[N0 * NUM_DIGITS_GF2X_ELEMENT], - AES_XOF_struct *seed_expander_ctx); - -void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_add_sparse( - int sizeR, POSITION_T Res[], - int sizeA, const POSITION_T A[], - int sizeB, const POSITION_T B[]); - -void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_transpose_in_place_sparse( - int sizeA, - POSITION_T A[]); - -void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_mul_sparse( - size_t sizeR, POSITION_T Res[], - size_t sizeA, const POSITION_T A[], - size_t sizeB, const POSITION_T B[]); - -void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_mul_dense_to_sparse( - DIGIT Res[], - const DIGIT dense[], - POSITION_T sparse[], - unsigned int nPos); - static inline int partition(POSITION_T arr[], int lo, int hi) { POSITION_T x = arr[hi]; POSITION_T tmp; @@ -155,4 +114,16 @@ static inline void quicksort_sparse(POSITION_T Res[]) { } } +void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_mul(DIGIT Res[], const DIGIT A[], const DIGIT B[]); +void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_transpose_in_place(DIGIT A[]); +void PQCLEAN_LEDAKEMLT12_CLEAN_rand_circulant_sparse_block(POSITION_T *pos_ones, int countOnes, AES_XOF_struct *seed_expander_ctx); +void PQCLEAN_LEDAKEMLT12_CLEAN_rand_circulant_blocks_sequence(DIGIT *sequence, AES_XOF_struct *seed_expander_ctx); +void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_add_sparse(int sizeR, POSITION_T Res[], int sizeA, const POSITION_T A[], int sizeB, const POSITION_T B[]); +void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_transpose_in_place_sparse(int sizeA, POSITION_T A[]); +void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_mul_sparse(size_t sizeR, POSITION_T Res[], size_t sizeA, const POSITION_T A[], size_t sizeB, const POSITION_T B[]); +void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_mul_dense_to_sparse(DIGIT Res[], const DIGIT dense[], POSITION_T sparse[], unsigned int nPos); +void PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_tobytes(uint8_t *bytes, const DIGIT *poly); + +int PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_inverse(DIGIT out[], const DIGIT in[]); + #endif diff --git a/crypto_kem/ledakemlt12/clean/gf2x_limbs.h b/crypto_kem/ledakemlt12/clean/gf2x_limbs.h deleted file mode 100644 index e4082a6d..00000000 --- a/crypto_kem/ledakemlt12/clean/gf2x_limbs.h +++ /dev/null @@ -1,18 +0,0 @@ -#ifndef GF2X_LIMBS_H -#define GF2X_LIMBS_H - -#include "qc_ldpc_parameters.h" - -#include -#include -#include - -typedef uint64_t DIGIT; -#define DIGIT_IS_UINT64 -#define DIGIT_IS_ULLONG -#define DIGIT_SIZE_B (8) -#define DIGIT_SIZE_b (DIGIT_SIZE_B << 3) - -#define POSITION_T uint32_t - -#endif diff --git a/crypto_kem/ledakemlt12/clean/kem.c b/crypto_kem/ledakemlt12/clean/kem.c index bf8413e7..8a2d1dc4 100644 --- a/crypto_kem/ledakemlt12/clean/kem.c +++ b/crypto_kem/ledakemlt12/clean/kem.c @@ -16,17 +16,10 @@ int PQCLEAN_LEDAKEMLT12_CLEAN_crypto_kem_keypair(unsigned char *pk, unsigned cha return 0; } -static void error_tobytes(uint8_t *error_bytes, const uint64_t *error_digits) { - size_t i, j, k; - uint64_t t; - +static void pack_error(uint8_t *error_bytes, const DIGIT *error_digits) { + size_t i; for (i = 0; i < N0; i++) { - for (j = 0; j < NUM_DIGITS_GF2X_ELEMENT; j++) { - t = error_digits[i * NUM_DIGITS_GF2X_ELEMENT + j]; - for (k = 0; k < DIGIT_SIZE_B; k++) { - error_bytes[(i * NUM_DIGITS_GF2X_ELEMENT + j) * DIGIT_SIZE_B + k] = (uint8_t) ((t >> (8 * k)) & 0xFF); - } - } + PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_tobytes(error_bytes + i * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B, error_digits + i * NUM_DIGITS_GF2X_ELEMENT); } } @@ -41,7 +34,7 @@ int PQCLEAN_LEDAKEMLT12_CLEAN_crypto_kem_enc(unsigned char *ct, unsigned char *s randombytes(encapsulated_key_seed, TRNG_BYTE_LENGTH); PQCLEAN_LEDAKEMLT12_CLEAN_seedexpander_from_trng(&niederreiter_encap_key_expander, encapsulated_key_seed); PQCLEAN_LEDAKEMLT12_CLEAN_rand_circulant_blocks_sequence(error_vector, &niederreiter_encap_key_expander); - error_tobytes(error_bytes, error_vector); + pack_error(error_bytes, error_vector); HASH_FUNCTION(ss, error_bytes, (N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B)); PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_encrypt((DIGIT *) ct, (publicKeyNiederreiter_t *) pk, error_vector); @@ -56,7 +49,7 @@ int PQCLEAN_LEDAKEMLT12_CLEAN_crypto_kem_dec(unsigned char *ss, const unsigned c uint8_t decoded_error_bytes[N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B]; PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_decrypt(decoded_error_vector, (privateKeyNiederreiter_t *)sk, (DIGIT *)ct); - error_tobytes(decoded_error_bytes, decoded_error_vector); + pack_error(decoded_error_bytes, decoded_error_vector); HASH_FUNCTION(ss, decoded_error_bytes, (N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B)); return 0; diff --git a/crypto_kem/ledakemlt12/clean/niederreiter.c b/crypto_kem/ledakemlt12/clean/niederreiter.c index 07da2d30..89005c5f 100644 --- a/crypto_kem/ledakemlt12/clean/niederreiter.c +++ b/crypto_kem/ledakemlt12/clean/niederreiter.c @@ -8,9 +8,7 @@ #include -void PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_keygen(publicKeyNiederreiter_t *pk, - privateKeyNiederreiter_t *sk, - AES_XOF_struct *keys_expander) { +void PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_keygen(publicKeyNiederreiter_t *pk, privateKeyNiederreiter_t *sk, AES_XOF_struct *keys_expander) { // sequence of N0 circ block matrices (p x p): Hi POSITION_T HPosOnes[N0][DV]; @@ -32,12 +30,8 @@ void PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_keygen(publicKeyNiederreiter_t *pk, int isDFRok = 0; sk->rejections = (int8_t) 0; do { - PQCLEAN_LEDAKEMLT12_CLEAN_generateHPosOnes_HtrPosOnes(HPosOnes, - HtrPosOnes, - keys_expander); - - PQCLEAN_LEDAKEMLT12_CLEAN_generateQsparse(QPosOnes, - keys_expander); + PQCLEAN_LEDAKEMLT12_CLEAN_generateHPosOnes_HtrPosOnes(HPosOnes, HtrPosOnes, keys_expander); + PQCLEAN_LEDAKEMLT12_CLEAN_generateQsparse(QPosOnes, keys_expander); for (int i = 0; i < N0; i++) { for (int j = 0; j < DV * M; j++) { LPosOnes[i][j] = INVALID_POS_VALUE; @@ -89,10 +83,7 @@ void PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_keygen(publicKeyNiederreiter_t *pk, } -void PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_encrypt(DIGIT *syndrome, // 1 polynomial - const publicKeyNiederreiter_t *pk, - const DIGIT *err) { // N0 polynomials - +void PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_encrypt(DIGIT *syndrome, const publicKeyNiederreiter_t *pk, const DIGIT *err) { int i; DIGIT saux[NUM_DIGITS_GF2X_ELEMENT]; @@ -101,21 +92,17 @@ void PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_encrypt(DIGIT *syndrome, // 1 polyn for (i = 0; i < N0 - 1; i++) { PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_mul(saux, pk->Mtr + i * NUM_DIGITS_GF2X_ELEMENT, - err + i * NUM_DIGITS_GF2X_ELEMENT - ); + err + i * NUM_DIGITS_GF2X_ELEMENT); gf2x_mod_add(syndrome, syndrome, saux); } // end for gf2x_mod_add(syndrome, syndrome, err + (N0 - 1)*NUM_DIGITS_GF2X_ELEMENT); } -int PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_decrypt(DIGIT *err, // N0 circ poly - const privateKeyNiederreiter_t *sk, - const DIGIT *syndrome) { +int PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_decrypt(DIGIT *err, const privateKeyNiederreiter_t *sk, const DIGIT *syndrome) { AES_XOF_struct niederreiter_decrypt_expander; - PQCLEAN_LEDAKEMLT12_CLEAN_seedexpander_from_trng(&niederreiter_decrypt_expander, - sk->prng_seed); + PQCLEAN_LEDAKEMLT12_CLEAN_seedexpander_from_trng(&niederreiter_decrypt_expander, sk->prng_seed); // sequence of N0 circ block matrices (p x p): POSITION_T HPosOnes[N0][DV]; @@ -124,8 +111,7 @@ int PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_decrypt(DIGIT *err, // N0 circ poly int rejections = sk->rejections; POSITION_T LPosOnes[N0][DV * M]; do { - PQCLEAN_LEDAKEMLT12_CLEAN_generateHPosOnes_HtrPosOnes(HPosOnes, HtrPosOnes, - &niederreiter_decrypt_expander); + PQCLEAN_LEDAKEMLT12_CLEAN_generateHPosOnes_HtrPosOnes(HPosOnes, HtrPosOnes, &niederreiter_decrypt_expander); PQCLEAN_LEDAKEMLT12_CLEAN_generateQsparse(QPosOnes, &niederreiter_decrypt_expander); for (int i = 0; i < N0; i++) { for (int j = 0; j < DV * M; j++) { @@ -173,28 +159,25 @@ int PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_decrypt(DIGIT *err, // N0 circ poly for (int i = 0; i < N0; i++) { PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_mul_sparse(DV * M, auxSparse, - DV, HPosOnes[i], - qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1] ] - ); + DV, HPosOnes[i], + qBlockWeights[i][N0 - 1], &QPosOnes[i][ M - qBlockWeights[i][N0 - 1]]); PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_add_sparse(DV * M, Ln0trSparse, DV * M, Ln0trSparse, - DV * M, auxSparse - ); + DV * M, auxSparse); } // end for i + PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_transpose_in_place_sparse(DV * M, Ln0trSparse); DIGIT privateSyndrome[NUM_DIGITS_GF2X_ELEMENT]; - PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_mul_dense_to_sparse(privateSyndrome, - syndrome, - Ln0trSparse, - DV * M); + PQCLEAN_LEDAKEMLT12_CLEAN_gf2x_mod_mul_dense_to_sparse(privateSyndrome, syndrome, Ln0trSparse, DV * M); /* prepare mockup error vector in case a decoding failure occurs */ DIGIT mockup_error_vector[N0 * NUM_DIGITS_GF2X_ELEMENT]; memset(mockup_error_vector, 0x00, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); memcpy(mockup_error_vector, syndrome, NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); PQCLEAN_LEDAKEMLT12_CLEAN_seedexpander(&niederreiter_decrypt_expander, - ((unsigned char *) mockup_error_vector) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B), TRNG_BYTE_LENGTH); + ((unsigned char *) mockup_error_vector) + (NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B), + TRNG_BYTE_LENGTH); int decryptOk = 0; memset(err, 0x00, N0 * NUM_DIGITS_GF2X_ELEMENT * DIGIT_SIZE_B); diff --git a/crypto_kem/ledakemlt12/clean/niederreiter.h b/crypto_kem/ledakemlt12/clean/niederreiter.h index efdd848a..0692581b 100644 --- a/crypto_kem/ledakemlt12/clean/niederreiter.h +++ b/crypto_kem/ledakemlt12/clean/niederreiter.h @@ -2,7 +2,6 @@ #define NIEDERREITER_H #include "gf2x_arith_mod_xPplusOne.h" -#include "gf2x_limbs.h" #include "qc_ldpc_parameters.h" #include "rng.h" @@ -21,23 +20,9 @@ typedef struct { // with P coefficients. } publicKeyNiederreiter_t; - - -void PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_keygen( - publicKeyNiederreiter_t *pk, - privateKeyNiederreiter_t *sk, - AES_XOF_struct *keys_expander); - -void PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_encrypt( - DIGIT syndrome[], - const publicKeyNiederreiter_t *pk, - const DIGIT *err); - -// return 1 if everything is ok -int PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_decrypt( - DIGIT *err, - const privateKeyNiederreiter_t *sk, - const DIGIT *syndrome); +void PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_keygen(publicKeyNiederreiter_t *pk, privateKeyNiederreiter_t *sk, AES_XOF_struct *keys_expander); +void PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_encrypt(DIGIT syndrome[], const publicKeyNiederreiter_t *pk, const DIGIT *err); +int PQCLEAN_LEDAKEMLT12_CLEAN_niederreiter_decrypt(DIGIT *err, const privateKeyNiederreiter_t *sk, const DIGIT *syndrome); #endif diff --git a/crypto_kem/ledakemlt12/clean/rng.h b/crypto_kem/ledakemlt12/clean/rng.h index 646bc86b..b34dbbc6 100644 --- a/crypto_kem/ledakemlt12/clean/rng.h +++ b/crypto_kem/ledakemlt12/clean/rng.h @@ -17,10 +17,7 @@ typedef struct { unsigned char ctr[16]; } AES_XOF_struct; - int PQCLEAN_LEDAKEMLT12_CLEAN_seedexpander(AES_XOF_struct *ctx, unsigned char *x, size_t xlen); - -/* TRNG_BYTE_LENGTH wide buffer */ void PQCLEAN_LEDAKEMLT12_CLEAN_seedexpander_from_trng(AES_XOF_struct *ctx, const unsigned char *trng_entropy); #endif