Add minimal Makefile and kyber768 as startingpoint

.gitignore

@@ -0,0 +1 @@
+bin/

Makefile

@@ -0,0 +1,21 @@
+
+# assumes a SCHEME variable; e.g. make functest_kem SCHEME=kyber768
+ifndef SCHEME
+	# TODO make this more granular, i.e. make clean should not require SCHEME
+$(error SCHEME variable is not set)
+endif
+
+functest_kem: crypto_kem/test.c $(wildcard crypto_kem/$(SCHEME)/clean/*.c) $(wildcard crypto_kem/$(SCHEME)/clean/*.h)
+	mkdir -p bin
+	$(CC) $(CFLAGS)\
+		-I"./common/"\
+		-I"crypto_kem/$(SCHEME)/clean/"\
+		-o bin/functest_kem_$(SCHEME)\
+		common/*.c\
+		crypto_kem/$(SCHEME)/clean/*.c\
+		crypto_kem/test.c
+
+.PHONY: clean
+
+clean:
+	rm -rf bin

crypto_kem/kyber768/clean/api.h

@@ -0,0 +1,19 @@
+#ifndef API_H
+#define API_H
+
+#include "params.h"
+
+#define CRYPTO_SECRETKEYBYTES  KYBER_SECRETKEYBYTES
+#define CRYPTO_PUBLICKEYBYTES  KYBER_PUBLICKEYBYTES
+#define CRYPTO_CIPHERTEXTBYTES KYBER_CIPHERTEXTBYTES
+#define CRYPTO_BYTES           KYBER_SYMBYTES
+
+#define CRYPTO_ALGNAME "Kyber768"
+
+int crypto_kem_keypair(unsigned char *pk, unsigned char *sk);
+
+int crypto_kem_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk);
+
+int crypto_kem_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk);
+
+#endif

crypto_kem/kyber768/clean/cbd.c

@@ -0,0 +1,113 @@
+#include "cbd.h"
+
+/*************************************************
+* Name:        load_littleendian
+* 
+* Description: load bytes into a 64-bit integer 
+*              in little-endian order
+*
+* Arguments:   - const unsigned char *x: pointer to input byte array
+*              - bytes:                  number of bytes to load, has to be <= 8
+*
+* Returns 64-bit unsigned integer loaded from x
+**************************************************/
+static uint64_t load_littleendian(const unsigned char *x, int bytes)
+{
+  int i;
+  uint64_t r = x[0];
+  for(i=1;i<bytes;i++)
+    r |= (uint64_t)x[i] << (8*i);
+  return r;
+}
+
+/*************************************************
+* Name:        cbd
+* 
+* Description: Given an array of uniformly random bytes, compute 
+*              polynomial with coefficients distributed according to
+*              a centered binomial distribution with parameter KYBER_ETA
+*
+* Arguments:   - poly *r:                  pointer to output polynomial  
+*              - const unsigned char *buf: pointer to input byte array
+**************************************************/
+void cbd(poly *r, const unsigned char *buf)
+{
+#if KYBER_ETA == 3
+  uint32_t t,d, a[4], b[4];
+  int i,j;
+
+  for(i=0;i<KYBER_N/4;i++)
+  {
+    t = load_littleendian(buf+3*i,3);
+    d = 0;
+    for(j=0;j<3;j++)
+      d += (t >> j) & 0x249249;
+
+    a[0] =  d & 0x7;
+    b[0] = (d >>  3) & 0x7;
+    a[1] = (d >>  6) & 0x7;
+    b[1] = (d >>  9) & 0x7;
+    a[2] = (d >> 12) & 0x7;
+    b[2] = (d >> 15) & 0x7;
+    a[3] = (d >> 18) & 0x7;
+    b[3] = (d >> 21);
+
+    r->coeffs[4*i+0] = a[0] + KYBER_Q - b[0];
+    r->coeffs[4*i+1] = a[1] + KYBER_Q - b[1];
+    r->coeffs[4*i+2] = a[2] + KYBER_Q - b[2];
+    r->coeffs[4*i+3] = a[3] + KYBER_Q - b[3];
+  }
+#elif KYBER_ETA == 4
+  uint32_t t,d, a[4], b[4];
+  int i,j;
+
+  for(i=0;i<KYBER_N/4;i++)
+  {
+    t = load_littleendian(buf+4*i,4);
+    d = 0;
+    for(j=0;j<4;j++)
+      d += (t >> j) & 0x11111111;
+
+    a[0] =  d & 0xf;
+    b[0] = (d >>  4) & 0xf;
+    a[1] = (d >>  8) & 0xf;
+    b[1] = (d >> 12) & 0xf;
+    a[2] = (d >> 16) & 0xf;
+    b[2] = (d >> 20) & 0xf;
+    a[3] = (d >> 24) & 0xf;
+    b[3] = (d >> 28);
+
+    r->coeffs[4*i+0] = a[0] + KYBER_Q - b[0];
+    r->coeffs[4*i+1] = a[1] + KYBER_Q - b[1];
+    r->coeffs[4*i+2] = a[2] + KYBER_Q - b[2];
+    r->coeffs[4*i+3] = a[3] + KYBER_Q - b[3];
+  }
+#elif KYBER_ETA == 5
+  uint64_t t,d, a[4], b[4];
+  int i,j;
+
+  for(i=0;i<KYBER_N/4;i++)
+  {
+    t = load_littleendian(buf+5*i,5);
+    d = 0;
+    for(j=0;j<5;j++)
+      d += (t >> j) & 0x0842108421UL;
+
+    a[0] =  d & 0x1f;
+    b[0] = (d >>  5) & 0x1f;
+    a[1] = (d >> 10) & 0x1f;
+    b[1] = (d >> 15) & 0x1f;
+    a[2] = (d >> 20) & 0x1f;
+    b[2] = (d >> 25) & 0x1f;
+    a[3] = (d >> 30) & 0x1f;
+    b[3] = (d >> 35);
+
+    r->coeffs[4*i+0] = a[0] + KYBER_Q - b[0];
+    r->coeffs[4*i+1] = a[1] + KYBER_Q - b[1];
+    r->coeffs[4*i+2] = a[2] + KYBER_Q - b[2];
+    r->coeffs[4*i+3] = a[3] + KYBER_Q - b[3];
+  }
+#else
+#error "poly_getnoise in poly.c only supports eta in {3,4,5}"
+#endif
+}

crypto_kem/kyber768/clean/cbd.h

@@ -0,0 +1,9 @@
+#ifndef CBD_H
+#define CBD_H
+
+#include <stdint.h>
+#include "poly.h"
+
+void cbd(poly *r, const unsigned char *buf);
+
+#endif

crypto_kem/kyber768/clean/indcpa.c

@@ -0,0 +1,308 @@
+#include <string.h>
+#include "indcpa.h"
+#include "poly.h"
+#include "polyvec.h"
+#include "randombytes.h"
+#include "fips202.h"
+#include "ntt.h"
+
+/*************************************************
+* Name:        pack_pk
+* 
+* Description: Serialize the public key as concatenation of the
+*              compressed and serialized vector of polynomials pk 
+*              and the public seed used to generate the matrix A.
+*
+* Arguments:   unsigned char *r:          pointer to the output serialized public key
+*              const poly *pk:            pointer to the input public-key polynomial
+*              const unsigned char *seed: pointer to the input public seed
+**************************************************/
+static void pack_pk(unsigned char *r, const polyvec *pk, const unsigned char *seed)
+{
+  int i;
+  polyvec_compress(r, pk);
+  for(i=0;i<KYBER_SYMBYTES;i++)
+    r[i+KYBER_POLYVECCOMPRESSEDBYTES] = seed[i];
+}
+
+/*************************************************
+* Name:        unpack_pk
+* 
+* Description: De-serialize and decompress public key from a byte array;
+*              approximate inverse of pack_pk
+*
+* Arguments:   - polyvec *pk:                   pointer to output public-key vector of polynomials
+*              - unsigned char *seed:           pointer to output seed to generate matrix A
+*              - const unsigned char *packedpk: pointer to input serialized public key
+**************************************************/
+static void unpack_pk(polyvec *pk, unsigned char *seed, const unsigned char *packedpk)
+{
+  int i;
+  polyvec_decompress(pk, packedpk);
+
+  for(i=0;i<KYBER_SYMBYTES;i++)
+    seed[i] = packedpk[i+KYBER_POLYVECCOMPRESSEDBYTES];
+}
+
+/*************************************************
+* Name:        pack_ciphertext
+* 
+* Description: Serialize the ciphertext as concatenation of the
+*              compressed and serialized vector of polynomials b
+*              and the compressed and serialized polynomial v
+*
+* Arguments:   unsigned char *r:          pointer to the output serialized ciphertext
+*              const poly *pk:            pointer to the input vector of polynomials b
+*              const unsigned char *seed: pointer to the input polynomial v
+**************************************************/
+static void pack_ciphertext(unsigned char *r, const polyvec *b, const poly *v)
+{
+  polyvec_compress(r, b);
+  poly_compress(r+KYBER_POLYVECCOMPRESSEDBYTES, v);
+}
+
+/*************************************************
+* Name:        unpack_ciphertext
+* 
+* Description: De-serialize and decompress ciphertext from a byte array;
+*              approximate inverse of pack_ciphertext
+*
+* Arguments:   - polyvec *b:             pointer to the output vector of polynomials b
+*              - poly *v:                pointer to the output polynomial v
+*              - const unsigned char *c: pointer to the input serialized ciphertext
+**************************************************/
+static void unpack_ciphertext(polyvec *b, poly *v, const unsigned char *c)
+{
+  polyvec_decompress(b, c);
+  poly_decompress(v, c+KYBER_POLYVECCOMPRESSEDBYTES);
+}
+
+/*************************************************
+* Name:        pack_sk
+* 
+* Description: Serialize the secret key
+*
+* Arguments:   - unsigned char *r:  pointer to output serialized secret key
+*              - const polyvec *sk: pointer to input vector of polynomials (secret key)
+**************************************************/
+static void pack_sk(unsigned char *r, const polyvec *sk)
+{
+  polyvec_tobytes(r, sk);
+}
+
+/*************************************************
+* Name:        unpack_sk
+* 
+* Description: De-serialize the secret key;
+*              inverse of pack_sk
+*
+* Arguments:   - polyvec *sk:                   pointer to output vector of polynomials (secret key)
+*              - const unsigned char *packedsk: pointer to input serialized secret key
+**************************************************/
+static void unpack_sk(polyvec *sk, const unsigned char *packedsk)
+{
+  polyvec_frombytes(sk, packedsk);
+}
+
+#define gen_a(A,B)  gen_matrix(A,B,0)
+#define gen_at(A,B) gen_matrix(A,B,1)
+
+/*************************************************
+* Name:        gen_matrix
+* 
+* Description: Deterministically generate matrix A (or the transpose of A)
+*              from a seed. Entries of the matrix are polynomials that look
+*              uniformly random. Performs rejection sampling on output of 
+*              SHAKE-128
+*
+* Arguments:   - polyvec *a:                pointer to ouptput matrix A
+*              - const unsigned char *seed: pointer to input seed
+*              - int transposed:            boolean deciding whether A or A^T is generated
+**************************************************/
+void gen_matrix(polyvec *a, const unsigned char *seed, int transposed) // Not static for benchmarking
+{
+  unsigned int pos=0, ctr;
+  uint16_t val;
+  unsigned int nblocks;
+  const unsigned int maxnblocks=4;
+  uint8_t buf[SHAKE128_RATE*maxnblocks];
+  int i,j;
+  uint64_t state[25]; // SHAKE state
+  unsigned char extseed[KYBER_SYMBYTES+2];
+
+  for(i=0;i<KYBER_SYMBYTES;i++)
+    extseed[i] = seed[i];
+
+
+  for(i=0;i<KYBER_K;i++)
+  {
+    for(j=0;j<KYBER_K;j++)
+    {
+      ctr = pos = 0;
+      nblocks = maxnblocks;
+      if(transposed) 
+      {
+        extseed[KYBER_SYMBYTES]   = i;
+        extseed[KYBER_SYMBYTES+1] = j;
+      }
+      else
+      {
+        extseed[KYBER_SYMBYTES]   = j;
+        extseed[KYBER_SYMBYTES+1] = i;
+      }
+        
+      shake128_absorb(state,extseed,KYBER_SYMBYTES+2);
+      shake128_squeezeblocks(buf,nblocks,state);
+
+      while(ctr < KYBER_N)
+      {
+        val = (buf[pos] | ((uint16_t) buf[pos+1] << 8)) & 0x1fff;
+        if(val < KYBER_Q)
+        {
+            a[i].vec[j].coeffs[ctr++] = val;
+        }
+        pos += 2;
+
+        if(pos > SHAKE128_RATE*nblocks-2)
+        {
+          nblocks = 1;
+          shake128_squeezeblocks(buf,nblocks,state);
+          pos = 0;
+        }
+      }
+    }
+  }
+}
+
+
+/*************************************************
+* Name:        indcpa_keypair
+* 
+* Description: Generates public and private key for the CPA-secure 
+*              public-key encryption scheme underlying Kyber
+*
+* Arguments:   - unsigned char *pk: pointer to output public key (of length KYBER_INDCPA_PUBLICKEYBYTES bytes)
+*              - unsigned char *sk: pointer to output private key (of length KYBER_INDCPA_SECRETKEYBYTES bytes)
+**************************************************/
+void indcpa_keypair(unsigned char *pk, 
+                   unsigned char *sk)
+{
+  polyvec a[KYBER_K], e, pkpv, skpv;
+  unsigned char buf[KYBER_SYMBYTES+KYBER_SYMBYTES];
+  unsigned char *publicseed = buf;
+  unsigned char *noiseseed = buf+KYBER_SYMBYTES;
+  int i;
+  unsigned char nonce=0;
+
+  randombytes(buf, KYBER_SYMBYTES);
+  sha3_512(buf, buf, KYBER_SYMBYTES);
+
+  gen_a(a, publicseed);
+
+  for(i=0;i<KYBER_K;i++)
+    poly_getnoise(skpv.vec+i,noiseseed,nonce++);
+
+  polyvec_ntt(&skpv);
+  
+  for(i=0;i<KYBER_K;i++)
+    poly_getnoise(e.vec+i,noiseseed,nonce++);
+
+  // matrix-vector multiplication
+  for(i=0;i<KYBER_K;i++)
+    polyvec_pointwise_acc(&pkpv.vec[i],&skpv,a+i);
+
+  polyvec_invntt(&pkpv);
+  polyvec_add(&pkpv,&pkpv,&e);
+
+  pack_sk(sk, &skpv);
+  pack_pk(pk, &pkpv, publicseed);
+}
+
+
+/*************************************************
+* Name:        indcpa_enc
+* 
+* Description: Encryption function of the CPA-secure 
+*              public-key encryption scheme underlying Kyber.
+*
+* Arguments:   - unsigned char *c:          pointer to output ciphertext (of length KYBER_INDCPA_BYTES bytes)
+*              - const unsigned char *m:    pointer to input message (of length KYBER_INDCPA_MSGBYTES bytes)
+*              - const unsigned char *pk:   pointer to input public key (of length KYBER_INDCPA_PUBLICKEYBYTES bytes)
+*              - const unsigned char *coin: pointer to input random coins used as seed (of length KYBER_SYMBYTES bytes)
+*                                           to deterministically generate all randomness
+**************************************************/
+void indcpa_enc(unsigned char *c,
+               const unsigned char *m,
+               const unsigned char *pk,
+               const unsigned char *coins)
+{
+  polyvec sp, pkpv, ep, at[KYBER_K], bp;
+  poly v, k, epp;
+  unsigned char seed[KYBER_SYMBYTES];
+  int i;
+  unsigned char nonce=0;
+
+
+  unpack_pk(&pkpv, seed, pk);
+
+  poly_frommsg(&k, m);
+
+  polyvec_ntt(&pkpv);
+
+  gen_at(at, seed);
+
+  for(i=0;i<KYBER_K;i++)
+    poly_getnoise(sp.vec+i,coins,nonce++);
+
+  polyvec_ntt(&sp);
+
+  for(i=0;i<KYBER_K;i++)
+    poly_getnoise(ep.vec+i,coins,nonce++);
+
+  // matrix-vector multiplication
+  for(i=0;i<KYBER_K;i++)
+    polyvec_pointwise_acc(&bp.vec[i],&sp,at+i);
+
+  polyvec_invntt(&bp);
+  polyvec_add(&bp, &bp, &ep);
+ 
+  polyvec_pointwise_acc(&v, &pkpv, &sp);
+  poly_invntt(&v);
+
+  poly_getnoise(&epp,coins,nonce++);
+
+  poly_add(&v, &v, &epp);
+  poly_add(&v, &v, &k);
+
+  pack_ciphertext(c, &bp, &v);
+}
+
+/*************************************************
+* Name:        indcpa_dec
+* 
+* Description: Decryption function of the CPA-secure 
+*              public-key encryption scheme underlying Kyber.
+*
+* Arguments:   - unsigned char *m:        pointer to output decrypted message (of length KYBER_INDCPA_MSGBYTES)
+*              - const unsigned char *c:  pointer to input ciphertext (of length KYBER_INDCPA_BYTES)
+*              - const unsigned char *sk: pointer to input secret key (of length KYBER_INDCPA_SECRETKEYBYTES)
+**************************************************/
+void indcpa_dec(unsigned char *m,
+               const unsigned char *c,
+               const unsigned char *sk)
+{
+  polyvec bp, skpv;
+  poly v, mp;
+
+  unpack_ciphertext(&bp, &v, c);
+  unpack_sk(&skpv, sk);
+
+  polyvec_ntt(&bp);
+
+  polyvec_pointwise_acc(&mp,&skpv,&bp);
+  poly_invntt(&mp);
+
+  poly_sub(&mp, &mp, &v);
+
+  poly_tomsg(m, &mp);
+}

crypto_kem/kyber768/clean/indcpa.h

@@ -0,0 +1,16 @@
+#ifndef INDCPA_H
+#define INDCPA_H
+
+void indcpa_keypair(unsigned char *pk, 
+                   unsigned char *sk);
+
+void indcpa_enc(unsigned char *c,
+               const unsigned char *m,
+               const unsigned char *pk,
+               const unsigned char *coins);
+
+void indcpa_dec(unsigned char *m,
+               const unsigned char *c,
+               const unsigned char *sk);
+
+#endif

crypto_kem/kyber768/clean/kem.c

@@ -0,0 +1,100 @@
+#include "api.h"
+#include "randombytes.h"
+#include "fips202.h"
+#include "params.h"
+#include "verify.h"
+#include "indcpa.h"
+
+/*************************************************
+* Name:        crypto_kem_keypair
+*
+* Description: Generates public and private key
+*              for CCA-secure Kyber key encapsulation mechanism
+*
+* Arguments:   - unsigned char *pk: pointer to output public key (an already allocated array of CRYPTO_PUBLICKEYBYTES bytes)
+*              - unsigned char *sk: pointer to output private key (an already allocated array of CRYPTO_SECRETKEYBYTES bytes)
+*
+* Returns 0 (success)
+**************************************************/
+int crypto_kem_keypair(unsigned char *pk, unsigned char *sk)
+{
+  size_t i;
+  indcpa_keypair(pk, sk);
+  for(i=0;i<KYBER_INDCPA_PUBLICKEYBYTES;i++)
+    sk[i+KYBER_INDCPA_SECRETKEYBYTES] = pk[i];
+  sha3_256(sk+KYBER_SECRETKEYBYTES-2*KYBER_SYMBYTES,pk,KYBER_PUBLICKEYBYTES);
+  randombytes(sk+KYBER_SECRETKEYBYTES-KYBER_SYMBYTES,KYBER_SYMBYTES);         /* Value z for pseudo-random output on reject */
+  return 0;
+}
+
+/*************************************************
+* Name:        crypto_kem_enc
+*
+* Description: Generates cipher text and shared
+*              secret for given public key
+*
+* Arguments:   - unsigned char *ct:       pointer to output cipher text (an already allocated array of CRYPTO_CIPHERTEXTBYTES bytes)
+*              - unsigned char *ss:       pointer to output shared secret (an already allocated array of CRYPTO_BYTES bytes)
+*              - const unsigned char *pk: pointer to input public key (an already allocated array of CRYPTO_PUBLICKEYBYTES bytes)
+*
+* Returns 0 (success)
+**************************************************/
+int crypto_kem_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk)
+{
+  unsigned char  kr[2*KYBER_SYMBYTES];                                        /* Will contain key, coins */
+  unsigned char buf[2*KYBER_SYMBYTES];                          
+
+  randombytes(buf, KYBER_SYMBYTES);
+  sha3_256(buf,buf,KYBER_SYMBYTES);                                           /* Don't release system RNG output */
+
+  sha3_256(buf+KYBER_SYMBYTES, pk, KYBER_PUBLICKEYBYTES);                     /* Multitarget countermeasure for coins + contributory KEM */
+  sha3_512(kr, buf, 2*KYBER_SYMBYTES);
+
+  indcpa_enc(ct, buf, pk, kr+KYBER_SYMBYTES);                                 /* coins are in kr+KYBER_SYMBYTES */
+
+  sha3_256(kr+KYBER_SYMBYTES, ct, KYBER_CIPHERTEXTBYTES);                     /* overwrite coins in kr with H(c) */
+  sha3_256(ss, kr, 2*KYBER_SYMBYTES);                                         /* hash concatenation of pre-k and H(c) to k */
+  return 0;
+}
+
+/*************************************************
+* Name:        crypto_kem_dec
+*
+* Description: Generates shared secret for given
+*              cipher text and private key
+*
+* Arguments:   - unsigned char *ss:       pointer to output shared secret (an already allocated array of CRYPTO_BYTES bytes)
+*              - const unsigned char *ct: pointer to input cipher text (an already allocated array of CRYPTO_CIPHERTEXTBYTES bytes)
+*              - const unsigned char *sk: pointer to input private key (an already allocated array of CRYPTO_SECRETKEYBYTES bytes)
+*
+* Returns 0.
+*
+* On failure, ss will contain a pseudo-random value.
+**************************************************/
+int crypto_kem_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk)
+{
+  size_t i; 
+  int fail;
+  unsigned char cmp[KYBER_CIPHERTEXTBYTES];
+  unsigned char buf[2*KYBER_SYMBYTES];
+  unsigned char kr[2*KYBER_SYMBYTES];                                         /* Will contain key, coins, qrom-hash */
+  const unsigned char *pk = sk+KYBER_INDCPA_SECRETKEYBYTES;
+
+  indcpa_dec(buf, ct, sk);
+                                                                              
+  for(i=0;i<KYBER_SYMBYTES;i++)                                               /* Multitarget countermeasure for coins + contributory KEM */
+    buf[KYBER_SYMBYTES+i] = sk[KYBER_SECRETKEYBYTES-2*KYBER_SYMBYTES+i];      /* Save hash by storing H(pk) in sk */
+  sha3_512(kr, buf, 2*KYBER_SYMBYTES);
+
+  indcpa_enc(cmp, buf, pk, kr+KYBER_SYMBYTES);                                /* coins are in kr+KYBER_SYMBYTES */
+
+  fail = verify(ct, cmp, KYBER_CIPHERTEXTBYTES);
+
+  sha3_256(kr+KYBER_SYMBYTES, ct, KYBER_CIPHERTEXTBYTES);                     /* overwrite coins in kr with H(c)  */
+
+  cmov(kr, sk+KYBER_SECRETKEYBYTES-KYBER_SYMBYTES, KYBER_SYMBYTES, fail);     /* Overwrite pre-k with z on re-encryption failure */
+
+  sha3_256(ss, kr, 2*KYBER_SYMBYTES);                                         /* hash concatenation of pre-k and H(c) to k */
+
+  return 0;
+}

crypto_kem/kyber768/clean/kex.c

@@ -0,0 +1,55 @@
+#include "kex.h"
+#include "verify.h"
+#include "fips202.h"
+
+void kyber_uake_initA(u8 *send, u8* tk, u8 *sk, const u8 *pkb)
+{
+  crypto_kem_keypair(send, sk);
+  crypto_kem_enc(send+KYBER_PUBLICKEYBYTES, tk, pkb);
+}
+
+void kyber_uake_sharedB(u8 *send, u8 *k, const u8* recv, const u8 *skb)
+{
+  unsigned char buf[2*KYBER_SYMBYTES];
+  crypto_kem_enc(send, buf, recv);
+  crypto_kem_dec(buf+KYBER_SYMBYTES, recv+KYBER_PUBLICKEYBYTES, skb);
+  shake256(k,KYBER_SYMBYTES,buf,2*KYBER_SYMBYTES);
+}
+
+void kyber_uake_sharedA(u8 *k, const u8 *recv, const u8 *tk, const u8 *sk)
+{
+  unsigned char buf[2*KYBER_SYMBYTES];
+  int i;
+  crypto_kem_dec(buf, recv, sk);
+  for(i=0;i<KYBER_SYMBYTES;i++) 
+    buf[i+KYBER_SYMBYTES] = tk[i];
+  shake256(k,KYBER_SYMBYTES,buf,2*KYBER_SYMBYTES);
+}
+
+
+
+void kyber_ake_initA(u8 *send, u8* tk, u8 *sk, const u8 *pkb)
+{
+  crypto_kem_keypair(send, sk);
+  crypto_kem_enc(send+KYBER_PUBLICKEYBYTES, tk, pkb);
+}
+
+void kyber_ake_sharedB(u8 *send, u8 *k, const u8* recv, const u8 *skb, const u8 *pka)
+{
+  unsigned char buf[3*KYBER_SYMBYTES];
+  crypto_kem_enc(send, buf, recv);
+  crypto_kem_enc(send+KYBER_CIPHERTEXTBYTES, buf+KYBER_SYMBYTES, pka);
+  crypto_kem_dec(buf+2*KYBER_SYMBYTES, recv+KYBER_PUBLICKEYBYTES, skb);
+  shake256(k,KYBER_SYMBYTES,buf,3*KYBER_SYMBYTES);
+}
+
+void kyber_ake_sharedA(u8 *k, const u8 *recv, const u8 *tk, const u8 *sk, const u8 *ska)
+{
+  unsigned char buf[3*KYBER_SYMBYTES];
+  int i;
+  crypto_kem_dec(buf, recv, sk);
+  crypto_kem_dec(buf+KYBER_SYMBYTES, recv+KYBER_CIPHERTEXTBYTES, ska);
+  for(i=0;i<KYBER_SYMBYTES;i++) 
+    buf[i+2*KYBER_SYMBYTES] = tk[i];
+  shake256(k,KYBER_SYMBYTES,buf,3*KYBER_SYMBYTES);
+}

crypto_kem/kyber768/clean/kex.h

@@ -0,0 +1,30 @@
+#ifndef KEX_H
+#define KEX_H
+
+#include "params.h"
+#include "api.h"
+
+#define KYBER_UAKE_SENDABYTES (KYBER_PUBLICKEYBYTES + KYBER_CIPHERTEXTBYTES)
+#define KYBER_UAKE_SENDBBYTES (KYBER_CIPHERTEXTBYTES)
+
+#define KYBER_AKE_SENDABYTES (KYBER_PUBLICKEYBYTES + KYBER_CIPHERTEXTBYTES)
+#define KYBER_AKE_SENDBBYTES (2*KYBER_CIPHERTEXTBYTES)
+
+
+typedef unsigned char u8;
+
+void kyber_uake_initA(u8 *send, u8* tk, u8 *sk, const u8 *pkb);
+
+void kyber_uake_sharedB(u8 *send, u8 *k, const u8* recv, const u8 *skb);
+
+void kyber_uake_sharedA(u8 *k, const u8 *recv, const u8 *tk, const u8 *sk);
+
+
+void kyber_ake_initA(u8 *send, u8* tk, u8 *sk, const u8 *pkb);
+
+void kyber_ake_sharedB(u8 *send, u8 *k, const u8* recv, const u8 *skb, const u8 *pka);
+
+void kyber_ake_sharedA(u8 *k, const u8 *recv, const u8 *tk, const u8 *sk, const u8 *ska);
+
+
+#endif

crypto_kem/kyber768/clean/ntt.c

@@ -0,0 +1,84 @@
+#include "inttypes.h"
+#include "ntt.h"
+#include "params.h"
+#include "reduce.h"
+
+extern const uint16_t omegas_inv_bitrev_montgomery[];
+extern const uint16_t psis_inv_montgomery[];
+extern const uint16_t zetas[];
+
+/*************************************************
+* Name:        ntt
+* 
+* Description: Computes negacyclic number-theoretic transform (NTT) of
+*              a polynomial (vector of 256 coefficients) in place; 
+*              inputs assumed to be in normal order, output in bitreversed order
+*
+* Arguments:   - uint16_t *p: pointer to in/output polynomial
+**************************************************/
+void ntt(uint16_t *p) 
+{
+  int level, start, j, k;
+  uint16_t zeta, t;
+
+  k = 1;
+  for(level = 7; level >= 0; level--) 
+  {
+    for(start = 0; start < KYBER_N; start = j + (1<<level)) 
+    {
+      zeta = zetas[k++];
+      for(j = start; j < start + (1<<level); ++j) 
+      {
+        t = montgomery_reduce((uint32_t)zeta * p[j + (1<<level)]);
+
+        p[j + (1<<level)] = barrett_reduce(p[j] + 4*KYBER_Q - t);
+
+        if(level & 1) /* odd level */
+          p[j] = p[j] + t; /* Omit reduction (be lazy) */
+        else 
+          p[j] = barrett_reduce(p[j] + t);
+      }
+    }
+  }
+}
+
+/*************************************************
+* Name:        invntt
+* 
+* Description: Computes inverse of negacyclic number-theoretic transform (NTT) of
+*              a polynomial (vector of 256 coefficients) in place; 
+*              inputs assumed to be in bitreversed order, output in normal order
+*
+* Arguments:   - uint16_t *a: pointer to in/output polynomial
+**************************************************/
+void invntt(uint16_t * a)
+{
+  int start, j, jTwiddle, level;
+  uint16_t temp, W;
+  uint32_t t;
+
+  for(level=0;level<8;level++)
+  {
+    for(start = 0; start < (1<<level);start++)
+    {
+      jTwiddle = 0;
+      for(j=start;j<KYBER_N-1;j+=2*(1<<level))
+      {
+        W = omegas_inv_bitrev_montgomery[jTwiddle++];
+        temp = a[j];
+
+        if(level & 1) /* odd level */
+          a[j] = barrett_reduce((temp + a[j + (1<<level)]));
+        else
+          a[j] = (temp + a[j + (1<<level)]); /* Omit reduction (be lazy) */
+
+        t = (W * ((uint32_t)temp + 4*KYBER_Q - a[j + (1<<level)]));
+
+        a[j + (1<<level)] = montgomery_reduce(t);
+      }
+    }
+  }
+
+  for(j = 0; j < KYBER_N; j++)
+    a[j] = montgomery_reduce((a[j] * psis_inv_montgomery[j]));
+}

crypto_kem/kyber768/clean/ntt.h

@@ -0,0 +1,9 @@
+#ifndef NTT_H
+#define NTT_H
+
+#include <stdint.h>
+
+void ntt(uint16_t* poly);
+void invntt(uint16_t* poly);
+
+#endif

crypto_kem/kyber768/clean/params.h

@@ -0,0 +1,27 @@
+#ifndef PARAMS_H
+#define PARAMS_H
+
+#define KYBER_K 3
+
+#define KYBER_N 256
+#define KYBER_Q 7681
+
+#define KYBER_ETA 4
+
+#define KYBER_SYMBYTES 32   /* size in bytes of shared key, hashes, and seeds */
+
+#define KYBER_POLYBYTES              416 
+#define KYBER_POLYCOMPRESSEDBYTES    96 
+#define KYBER_POLYVECBYTES           (KYBER_K * KYBER_POLYBYTES)   
+#define KYBER_POLYVECCOMPRESSEDBYTES (KYBER_K * 352) 
+
+#define KYBER_INDCPA_MSGBYTES       KYBER_SYMBYTES
+#define KYBER_INDCPA_PUBLICKEYBYTES (KYBER_POLYVECCOMPRESSEDBYTES + KYBER_SYMBYTES)
+#define KYBER_INDCPA_SECRETKEYBYTES (KYBER_POLYVECBYTES)
+#define KYBER_INDCPA_BYTES          (KYBER_POLYVECCOMPRESSEDBYTES + KYBER_POLYCOMPRESSEDBYTES)
+
+#define KYBER_PUBLICKEYBYTES  (KYBER_INDCPA_PUBLICKEYBYTES)
+#define KYBER_SECRETKEYBYTES  (KYBER_INDCPA_SECRETKEYBYTES +  KYBER_INDCPA_PUBLICKEYBYTES + 2*KYBER_SYMBYTES) /* 32 bytes of additional space to save H(pk) */
+#define KYBER_CIPHERTEXTBYTES  KYBER_INDCPA_BYTES
+
+#endif

crypto_kem/kyber768/clean/poly.c

@@ -0,0 +1,249 @@
+#include <stdio.h>
+#include "poly.h"
+#include "ntt.h"
+#include "polyvec.h"
+#include "reduce.h"
+#include "cbd.h"
+#include "fips202.h"
+
+/*************************************************
+* Name:        poly_compress
+* 
+* Description: Compression and subsequent serialization of a polynomial
+*
+* Arguments:   - unsigned char *r: pointer to output byte array
+*              - const poly *a:    pointer to input polynomial
+**************************************************/
+void poly_compress(unsigned char *r, const poly *a)
+{
+  uint32_t t[8];
+  unsigned int i,j,k=0;
+
+  for(i=0;i<KYBER_N;i+=8)
+  {
+    for(j=0;j<8;j++)
+      t[j] = (((freeze(a->coeffs[i+j]) << 3) + KYBER_Q/2)/KYBER_Q) & 7;
+
+    r[k]   =  t[0]       | (t[1] << 3) | (t[2] << 6);
+    r[k+1] = (t[2] >> 2) | (t[3] << 1) | (t[4] << 4) | (t[5] << 7);
+    r[k+2] = (t[5] >> 1) | (t[6] << 2) | (t[7] << 5);
+    k += 3;
+  }
+}
+
+/*************************************************
+* Name:        poly_decompress
+* 
+* Description: De-serialization and subsequent decompression of a polynomial; 
+*              approximate inverse of poly_compress
+*
+* Arguments:   - poly *r:                pointer to output polynomial
+*              - const unsigned char *a: pointer to input byte array
+**************************************************/
+void poly_decompress(poly *r, const unsigned char *a)
+{
+  unsigned int i;
+  for(i=0;i<KYBER_N;i+=8)
+  {
+    r->coeffs[i+0] =  (((a[0] & 7) * KYBER_Q) + 4)>> 3;
+    r->coeffs[i+1] = ((((a[0] >> 3) & 7) * KYBER_Q)+ 4) >> 3;
+    r->coeffs[i+2] = ((((a[0] >> 6) | ((a[1] << 2) & 4)) * KYBER_Q) + 4)>> 3;
+    r->coeffs[i+3] = ((((a[1] >> 1) & 7) * KYBER_Q) + 4)>> 3;
+    r->coeffs[i+4] = ((((a[1] >> 4) & 7) * KYBER_Q) + 4)>> 3;
+    r->coeffs[i+5] = ((((a[1] >> 7) | ((a[2] << 1) & 6)) * KYBER_Q) + 4)>> 3;
+    r->coeffs[i+6] = ((((a[2] >> 2) & 7) * KYBER_Q) + 4)>> 3;
+    r->coeffs[i+7] = ((((a[2] >> 5)) * KYBER_Q) + 4)>> 3;
+    a += 3;
+  }
+}
+
+/*************************************************
+* Name:        poly_tobytes
+* 
+* Description: Serialization of a polynomial
+*
+* Arguments:   - unsigned char *r: pointer to output byte array
+*              - const poly *a:    pointer to input polynomial
+**************************************************/
+void poly_tobytes(unsigned char *r, const poly *a)
+{
+  int i,j;
+  uint16_t t[8];
+
+  for(i=0;i<KYBER_N/8;i++)
+  {
+    for(j=0;j<8;j++)
+      t[j] = freeze(a->coeffs[8*i+j]);
+
+    r[13*i+ 0] =  t[0]        & 0xff;
+    r[13*i+ 1] = (t[0] >>  8) | ((t[1] & 0x07) << 5);
+    r[13*i+ 2] = (t[1] >>  3) & 0xff;
+    r[13*i+ 3] = (t[1] >> 11) | ((t[2] & 0x3f) << 2);
+    r[13*i+ 4] = (t[2] >>  6) | ((t[3] & 0x01) << 7);
+    r[13*i+ 5] = (t[3] >>  1) & 0xff;
+    r[13*i+ 6] = (t[3] >>  9) | ((t[4] & 0x0f) << 4);
+    r[13*i+ 7] = (t[4] >>  4) & 0xff;
+    r[13*i+ 8] = (t[4] >> 12) | ((t[5] & 0x7f) << 1);
+    r[13*i+ 9] = (t[5] >>  7) | ((t[6] & 0x03) << 6);
+    r[13*i+10] = (t[6] >>  2) & 0xff;
+    r[13*i+11] = (t[6] >> 10) | ((t[7] & 0x1f) << 3);
+    r[13*i+12] = (t[7] >>  5);
+  }
+}
+
+/*************************************************
+* Name:        poly_frombytes
+* 
+* Description: De-serialization of a polynomial; 
+*              inverse of poly_tobytes
+*
+* Arguments:   - poly *r:                pointer to output polynomial
+*              - const unsigned char *a: pointer to input byte array
+**************************************************/
+void poly_frombytes(poly *r, const unsigned char *a)
+{
+  int i;
+  for(i=0;i<KYBER_N/8;i++)
+  {
+    r->coeffs[8*i+0] =  a[13*i+ 0]       | (((uint16_t)a[13*i+ 1] & 0x1f) << 8);
+    r->coeffs[8*i+1] = (a[13*i+ 1] >> 5) | (((uint16_t)a[13*i+ 2]       ) << 3) | (((uint16_t)a[13*i+ 3] & 0x03) << 11);
+    r->coeffs[8*i+2] = (a[13*i+ 3] >> 2) | (((uint16_t)a[13*i+ 4] & 0x7f) << 6);
+    r->coeffs[8*i+3] = (a[13*i+ 4] >> 7) | (((uint16_t)a[13*i+ 5]       ) << 1) | (((uint16_t)a[13*i+ 6] & 0x0f) <<  9);
+    r->coeffs[8*i+4] = (a[13*i+ 6] >> 4) | (((uint16_t)a[13*i+ 7]       ) << 4) | (((uint16_t)a[13*i+ 8] & 0x01) << 12);
+    r->coeffs[8*i+5] = (a[13*i+ 8] >> 1) | (((uint16_t)a[13*i+ 9] & 0x3f) << 7);
+    r->coeffs[8*i+6] = (a[13*i+ 9] >> 6) | (((uint16_t)a[13*i+10]       ) << 2) | (((uint16_t)a[13*i+11] & 0x07) << 10);
+    r->coeffs[8*i+7] = (a[13*i+11] >> 3) | (((uint16_t)a[13*i+12]       ) << 5);
+  }
+}
+
+/*************************************************
+* Name:        poly_getnoise
+* 
+* Description: Sample a polynomial deterministically from a seed and a nonce,
+*              with output polynomial close to centered binomial distribution
+*              with parameter KYBER_ETA
+*
+* Arguments:   - poly *r:                   pointer to output polynomial
+*              - const unsigned char *seed: pointer to input seed 
+*              - unsigned char nonce:       one-byte input nonce
+**************************************************/
+void poly_getnoise(poly *r,const unsigned char *seed, unsigned char nonce)
+{
+  unsigned char buf[KYBER_ETA*KYBER_N/4];
+  unsigned char extseed[KYBER_SYMBYTES+1];
+  int i;
+
+  for(i=0;i<KYBER_SYMBYTES;i++)
+    extseed[i] = seed[i];
+  extseed[KYBER_SYMBYTES] = nonce;
+     
+  shake256(buf,KYBER_ETA*KYBER_N/4,extseed,KYBER_SYMBYTES+1);
+
+  cbd(r, buf);
+}
+
+/*************************************************
+* Name:        poly_ntt
+* 
+* Description: Computes negacyclic number-theoretic transform (NTT) of
+*              a polynomial in place; 
+*              inputs assumed to be in normal order, output in bitreversed order
+*
+* Arguments:   - uint16_t *r: pointer to in/output polynomial
+**************************************************/
+void poly_ntt(poly *r)
+{
+  ntt(r->coeffs);
+}
+
+/*************************************************
+* Name:        poly_invntt
+* 
+* Description: Computes inverse of negacyclic number-theoretic transform (NTT) of
+*              a polynomial in place; 
+*              inputs assumed to be in bitreversed order, output in normal order
+*
+* Arguments:   - uint16_t *a: pointer to in/output polynomial
+**************************************************/
+void poly_invntt(poly *r)
+{
+  invntt(r->coeffs);
+}
+ 
+/*************************************************
+* Name:        poly_add
+* 
+* Description: Add two polynomials
+*
+* Arguments: - poly *r:       pointer to output polynomial
+*            - const poly *a: pointer to first input polynomial
+*            - const poly *b: pointer to second input polynomial
+**************************************************/ 
+void poly_add(poly *r, const poly *a, const poly *b)
+{
+  int i;
+  for(i=0;i<KYBER_N;i++)
+    r->coeffs[i] = barrett_reduce(a->coeffs[i] + b->coeffs[i]);
+}
+
+/*************************************************
+* Name:        poly_sub
+* 
+* Description: Subtract two polynomials
+*
+* Arguments: - poly *r:       pointer to output polynomial
+*            - const poly *a: pointer to first input polynomial
+*            - const poly *b: pointer to second input polynomial
+**************************************************/ 
+void poly_sub(poly *r, const poly *a, const poly *b)
+{
+  int i;
+  for(i=0;i<KYBER_N;i++)
+    r->coeffs[i] = barrett_reduce(a->coeffs[i] + 3*KYBER_Q - b->coeffs[i]);
+}
+
+/*************************************************
+* Name:        poly_frommsg
+* 
+* Description: Convert 32-byte message to polynomial
+*
+* Arguments:   - poly *r:                  pointer to output polynomial
+*              - const unsigned char *msg: pointer to input message
+**************************************************/
+void poly_frommsg(poly *r, const unsigned char msg[KYBER_SYMBYTES])
+{
+  uint16_t i,j,mask;
+
+  for(i=0;i<KYBER_SYMBYTES;i++)
+  {
+    for(j=0;j<8;j++)
+    {   
+      mask = -((msg[i] >> j)&1);
+      r->coeffs[8*i+j] = mask & ((KYBER_Q+1)/2);
+    }   
+  }
+}
+
+/*************************************************
+* Name:        poly_tomsg
+* 
+* Description: Convert polynomial to 32-byte message
+*
+* Arguments:   - unsigned char *msg: pointer to output message
+*              - const poly *a:      pointer to input polynomial
+**************************************************/
+void poly_tomsg(unsigned char msg[KYBER_SYMBYTES], const poly *a)
+{
+  uint16_t t;
+  int i,j;
+
+  for(i=0;i<KYBER_SYMBYTES;i++)
+  {
+    msg[i] = 0;
+    for(j=0;j<8;j++)
+    {
+      t = (((freeze(a->coeffs[8*i+j]) << 1) + KYBER_Q/2)/KYBER_Q) & 1;
+      msg[i] |= t << j;
+    }
+  }
+}

crypto_kem/kyber768/clean/poly.h

@@ -0,0 +1,32 @@
+#ifndef POLY_H
+#define POLY_H
+
+#include <stdint.h>
+#include "params.h"
+
+/* 
+ * Elements of R_q = Z_q[X]/(X^n + 1). Represents polynomial
+ * coeffs[0] + X*coeffs[1] + X^2*xoeffs[2] + ... + X^{n-1}*coeffs[n-1] 
+ */
+typedef struct{
+  uint16_t coeffs[KYBER_N];
+} poly;
+
+void poly_compress(unsigned char *r, const poly *a);
+void poly_decompress(poly *r, const unsigned char *a);
+
+void poly_tobytes(unsigned char *r, const poly *a);
+void poly_frombytes(poly *r, const unsigned char *a);
+
+void poly_frommsg(poly *r, const unsigned char msg[KYBER_SYMBYTES]);
+void poly_tomsg(unsigned char msg[KYBER_SYMBYTES], const poly *r);
+
+void poly_getnoise(poly *r,const unsigned char *seed, unsigned char nonce);
+
+void poly_ntt(poly *r);
+void poly_invntt(poly *r);
+  
+void poly_add(poly *r, const poly *a, const poly *b);
+void poly_sub(poly *r, const poly *a, const poly *b);
+
+#endif

crypto_kem/kyber768/clean/polyvec.c

@@ -0,0 +1,171 @@
+#include <stdio.h>
+#include "polyvec.h"
+#include "fips202.h"
+#include "cbd.h"
+#include "reduce.h"
+
+/*************************************************
+* Name:        polyvec_compress
+* 
+* Description: Compress and serialize vector of polynomials
+*
+* Arguments:   - unsigned char *r: pointer to output byte array 
+*              - const polyvec *a: pointer to input vector of polynomials
+**************************************************/
+void polyvec_compress(unsigned char *r, const polyvec *a)
+{
+  int i,j,k;
+  uint16_t t[8];
+  for(i=0;i<KYBER_K;i++)
+  {
+    for(j=0;j<KYBER_N/8;j++)
+    {
+      for(k=0;k<8;k++)
+        t[k] = ((((uint32_t)freeze(a->vec[i].coeffs[8*j+k]) << 11) + KYBER_Q/2)/ KYBER_Q) & 0x7ff;
+
+      r[11*j+ 0] =  t[0] & 0xff;
+      r[11*j+ 1] = (t[0] >>  8) | ((t[1] & 0x1f) << 3);
+      r[11*j+ 2] = (t[1] >>  5) | ((t[2] & 0x03) << 6);
+      r[11*j+ 3] = (t[2] >>  2) & 0xff;
+      r[11*j+ 4] = (t[2] >> 10) | ((t[3] & 0x7f) << 1);
+      r[11*j+ 5] = (t[3] >>  7) | ((t[4] & 0x0f) << 4);
+      r[11*j+ 6] = (t[4] >>  4) | ((t[5] & 0x01) << 7);
+      r[11*j+ 7] = (t[5] >>  1) & 0xff;
+      r[11*j+ 8] = (t[5] >>  9) | ((t[6] & 0x3f) << 2);
+      r[11*j+ 9] = (t[6] >>  6) | ((t[7] & 0x07) << 5);
+      r[11*j+10] = (t[7] >>  3);
+    }
+    r += 352;
+  }
+}
+
+/*************************************************
+* Name:        polyvec_decompress
+* 
+* Description: De-serialize and decompress vector of polynomials;
+*              approximate inverse of polyvec_compress
+*
+* Arguments:   - polyvec *r:       pointer to output vector of polynomials
+*              - unsigned char *a: pointer to input byte array
+**************************************************/
+void polyvec_decompress(polyvec *r, const unsigned char *a)
+{
+  int i,j;
+  for(i=0;i<KYBER_K;i++)
+  {
+    for(j=0;j<KYBER_N/8;j++)
+    {
+      r->vec[i].coeffs[8*j+0] =  (((a[11*j+ 0]       | (((uint32_t)a[11*j+ 1] & 0x07) << 8)) * KYBER_Q) +1024) >> 11;
+      r->vec[i].coeffs[8*j+1] = ((((a[11*j+ 1] >> 3) | (((uint32_t)a[11*j+ 2] & 0x3f) << 5)) * KYBER_Q) +1024) >> 11;
+      r->vec[i].coeffs[8*j+2] = ((((a[11*j+ 2] >> 6) | (((uint32_t)a[11*j+ 3] & 0xff) << 2) |  (((uint32_t)a[11*j+ 4] & 0x01) << 10)) * KYBER_Q) + 1024) >> 11;
+      r->vec[i].coeffs[8*j+3] = ((((a[11*j+ 4] >> 1) | (((uint32_t)a[11*j+ 5] & 0x0f) << 7)) * KYBER_Q) + 1024) >> 11;
+      r->vec[i].coeffs[8*j+4] = ((((a[11*j+ 5] >> 4) | (((uint32_t)a[11*j+ 6] & 0x7f) << 4)) * KYBER_Q) + 1024) >> 11;
+      r->vec[i].coeffs[8*j+5] = ((((a[11*j+ 6] >> 7) | (((uint32_t)a[11*j+ 7] & 0xff) << 1) |  (((uint32_t)a[11*j+ 8] & 0x03) <<  9)) * KYBER_Q) + 1024) >> 11;
+      r->vec[i].coeffs[8*j+6] = ((((a[11*j+ 8] >> 2) | (((uint32_t)a[11*j+ 9] & 0x1f) << 6)) * KYBER_Q) + 1024) >> 11;
+      r->vec[i].coeffs[8*j+7] = ((((a[11*j+ 9] >> 5) | (((uint32_t)a[11*j+10] & 0xff) << 3)) * KYBER_Q) + 1024) >> 11;
+    }
+    a += 352;
+  }
+}
+
+/*************************************************
+* Name:        polyvec_tobytes
+* 
+* Description: Serialize vector of polynomials
+*
+* Arguments:   - unsigned char *r: pointer to output byte array 
+*              - const polyvec *a: pointer to input vector of polynomials
+**************************************************/
+void polyvec_tobytes(unsigned char *r, const polyvec *a)
+{
+  int i;
+  for(i=0;i<KYBER_K;i++)
+    poly_tobytes(r+i*KYBER_POLYBYTES, &a->vec[i]);
+}
+
+/*************************************************
+* Name:        polyvec_frombytes
+* 
+* Description: De-serialize vector of polynomials;
+*              inverse of polyvec_tobytes 
+*
+* Arguments:   - unsigned char *r: pointer to output byte array 
+*              - const polyvec *a: pointer to input vector of polynomials
+**************************************************/
+void polyvec_frombytes(polyvec *r, const unsigned char *a)
+{
+  int i;
+  for(i=0;i<KYBER_K;i++)
+    poly_frombytes(&r->vec[i], a+i*KYBER_POLYBYTES);
+}
+
+/*************************************************
+* Name:        polyvec_ntt
+* 
+* Description: Apply forward NTT to all elements of a vector of polynomials
+*
+* Arguments:   - polyvec *r: pointer to in/output vector of polynomials
+**************************************************/
+void polyvec_ntt(polyvec *r)
+{
+  int i;
+  for(i=0;i<KYBER_K;i++)
+    poly_ntt(&r->vec[i]);
+}
+
+/*************************************************
+* Name:        polyvec_invntt
+* 
+* Description: Apply inverse NTT to all elements of a vector of polynomials
+*
+* Arguments:   - polyvec *r: pointer to in/output vector of polynomials
+**************************************************/
+void polyvec_invntt(polyvec *r)
+{
+  int i;
+  for(i=0;i<KYBER_K;i++)
+    poly_invntt(&r->vec[i]);
+}
+ 
+/*************************************************
+* Name:        polyvec_pointwise_acc
+* 
+* Description: Pointwise multiply elements of a and b and accumulate into r
+*
+* Arguments: - poly *r:          pointer to output polynomial
+*            - const polyvec *a: pointer to first input vector of polynomials
+*            - const polyvec *b: pointer to second input vector of polynomials
+**************************************************/ 
+void polyvec_pointwise_acc(poly *r, const polyvec *a, const polyvec *b)
+{
+  int i,j;
+  uint16_t t;
+  for(j=0;j<KYBER_N;j++)
+  {
+    t = montgomery_reduce(4613* (uint32_t)b->vec[0].coeffs[j]); // 4613 = 2^{2*18} % q
+    r->coeffs[j] = montgomery_reduce(a->vec[0].coeffs[j] * t);
+    for(i=1;i<KYBER_K;i++)
+    {
+      t = montgomery_reduce(4613* (uint32_t)b->vec[i].coeffs[j]);
+      r->coeffs[j] += montgomery_reduce(a->vec[i].coeffs[j] * t);
+    }
+    r->coeffs[j] = barrett_reduce(r->coeffs[j]);
+  }
+}
+
+/*************************************************
+* Name:        polyvec_add
+* 
+* Description: Add vectors of polynomials
+*
+* Arguments: - polyvec *r:       pointer to output vector of polynomials
+*            - const polyvec *a: pointer to first input vector of polynomials
+*            - const polyvec *b: pointer to second input vector of polynomials
+**************************************************/ 
+void polyvec_add(polyvec *r, const polyvec *a, const polyvec *b)
+{
+  int i;
+  for(i=0;i<KYBER_K;i++)
+    poly_add(&r->vec[i], &a->vec[i], &b->vec[i]);
+
+}

crypto_kem/kyber768/clean/polyvec.h

@@ -0,0 +1,24 @@
+#ifndef POLYVEC_H
+#define POLYVEC_H
+
+#include "params.h"
+#include "poly.h"
+
+typedef struct{
+  poly vec[KYBER_K];
+} polyvec;
+
+void polyvec_compress(unsigned char *r, const polyvec *a);
+void polyvec_decompress(polyvec *r, const unsigned char *a);
+
+void polyvec_tobytes(unsigned char *r, const polyvec *a);
+void polyvec_frombytes(polyvec *r, const unsigned char *a);
+
+void polyvec_ntt(polyvec *r);
+void polyvec_invntt(polyvec *r);
+  
+void polyvec_pointwise_acc(poly *r, const polyvec *a, const polyvec *b);
+
+void polyvec_add(polyvec *r, const polyvec *a, const polyvec *b);
+
+#endif

crypto_kem/kyber768/clean/precomp.c

@@ -0,0 +1,82 @@
+#include "inttypes.h"
+#include "ntt.h"
+#include "params.h"
+
+/* Precomputed constants for the forward NTT and inverse NTT.
+ * Computed using Pari/GP as follows:
+ *
+brv=[0,128,64,192,32,160,96,224,16,144,80,208,48,176,112,240, \
+     8,136,72,200,40,168,104,232,24,152,88,216,56,184,120,248, \
+     4,132,68,196,36,164,100,228,20,148,84,212,52,180,116,244, \
+     12,140,76,204,44,172,108,236,28,156,92,220,60,188,124,252, \
+     2,130,66,194,34,162,98,226,18,146,82,210,50,178,114,242, \
+     10,138,74,202,42,170,106,234,26,154,90,218,58,186,122,250, \
+     6,134,70,198,38,166,102,230,22,150,86,214,54,182,118,246, \
+     14,142,78,206,46,174,110,238,30,158,94,222,62,190,126,254, \
+     1,129,65,193,33,161,97,225,17,145,81,209,49,177,113,241, \
+     9,137,73,201,41,169,105,233,25,153,89,217,57,185,121,249, \
+     5,133,69,197,37,165,101,229,21,149,85,213,53,181,117,245, \
+     13,141,77,205,45,173,109,237,29,157,93,221,61,189,125,253, \
+     3,131,67,195,35,163,99,227,19,147,83,211,51,179,115,243, \
+     11,139,75,203,43,171,107,235,27,155,91,219,59,187,123,251, \
+     7,135,71,199,39,167,103,231,23,151,87,215,55,183,119,247, \
+     15,143,79,207,47,175,111,239,31,159,95,223,63,191,127,255];
+
+q = 7681;
+n = 256;
+mont = Mod(2^18,q);
+
+g=0; for(i=2,q-1,if(znorder(Mod(i,q)) == 2*n, g=Mod(i,q); break))
+
+zetas = lift(vector(n, i, g^(brv[i])*mont))
+omegas_inv_bitrev_montgomery = lift(vector(n/2, i, (g^2)^(-brv[2*(i-1)+1])*mont))
+psis_inv_montgomery = lift(vector(n, i, g^(-(i-1))/n*mont))
+
+*/
+
+const uint16_t zetas[KYBER_N] = {
+  990, 7427, 2634, 6819, 578, 3281, 2143, 1095, 484, 6362, 3336, 5382, 6086, 3823, 877, 5656,
+  3583, 7010, 6414, 263, 1285, 291, 7143, 7338, 1581, 5134, 5184, 5932, 4042, 5775, 2468, 3,
+  606, 729, 5383, 962, 3240, 7548, 5129, 7653, 5929, 4965, 2461, 641, 1584, 2666, 1142, 157,
+  7407, 5222, 5602, 5142, 6140, 5485, 4931, 1559, 2085, 5284, 2056, 3538, 7269, 3535, 7190, 1957,
+  3465, 6792, 1538, 4664, 2023, 7643, 3660, 7673, 1694, 6905, 3995, 3475, 5939, 1859, 6910, 4434,
+  1019, 1492, 7087, 4761, 657, 4859, 5798, 2640, 1693, 2607, 2782, 5400, 6466, 1010, 957, 3851,
+  2121, 6392, 7319, 3367, 3659, 3375, 6430, 7583, 1549, 5856, 4773, 6084, 5544, 1650, 3997, 4390,
+  6722, 2915, 4245, 2635, 6128, 7676, 5737, 1616, 3457, 3132, 7196, 4702, 6239, 851, 2122, 3009,
+  7613, 7295, 2007, 323, 5112, 3716, 2289, 6442, 6965, 2713, 7126, 3401, 963, 6596, 607, 5027,
+  7078, 4484, 5937, 944, 2860, 2680, 5049, 1777, 5850, 3387, 6487, 6777, 4812, 4724, 7077, 186,
+  6848, 6793, 3463, 5877, 1174, 7116, 3077, 5945, 6591, 590, 6643, 1337, 6036, 3991, 1675, 2053,
+  6055, 1162, 1679, 3883, 4311, 2106, 6163, 4486, 6374, 5006, 4576, 4288, 5180, 4102, 282, 6119,
+  7443, 6330, 3184, 4971, 2530, 5325, 4171, 7185, 5175, 5655, 1898, 382, 7211, 43, 5965, 6073,
+  1730, 332, 1577, 3304, 2329, 1699, 6150, 2379, 5113, 333, 3502, 4517, 1480, 1172, 5567, 651,
+  925, 4573, 599, 1367, 4109, 1863, 6929, 1605, 3866, 2065, 4048, 839, 5764, 2447, 2022, 3345,
+  1990, 4067, 2036, 2069, 3567, 7371, 2368, 339, 6947, 2159, 654, 7327, 2768, 6676, 987, 2214};
+
+const uint16_t omegas_inv_bitrev_montgomery[KYBER_N/2] = {
+  990, 254, 862, 5047, 6586, 5538, 4400, 7103, 2025, 6804, 3858, 1595, 2299, 4345, 1319, 7197,
+  7678, 5213, 1906, 3639, 1749, 2497, 2547, 6100, 343, 538, 7390, 6396, 7418, 1267, 671, 4098,
+  5724, 491, 4146, 412, 4143, 5625, 2397, 5596, 6122, 2750, 2196, 1541, 2539, 2079, 2459, 274,
+  7524, 6539, 5015, 6097, 7040, 5220, 2716, 1752, 28, 2552, 133, 4441, 6719, 2298, 6952, 7075,
+  4672, 5559, 6830, 1442, 2979, 485, 4549, 4224, 6065, 1944, 5, 1553, 5046, 3436, 4766, 959,
+  3291, 3684, 6031, 2137, 1597, 2908, 1825, 6132, 98, 1251, 4306, 4022, 4314, 362, 1289, 5560,
+  3830, 6724, 6671, 1215, 2281, 4899, 5074, 5988, 5041, 1883, 2822, 7024, 2920, 594, 6189, 6662,
+  3247, 771, 5822, 1742, 4206, 3686, 776, 5987, 8, 4021, 38, 5658, 3017, 6143, 889, 4216};
+
+const uint16_t psis_inv_montgomery[KYBER_N] = {
+  1024, 4972, 5779, 6907, 4943, 4168,  315, 5580,   90,  497, 1123,  142, 4710, 5527, 2443, 4871, 
+   698, 2489, 2394, 4003,  684, 2241, 2390, 7224, 5072, 2064, 4741, 1687, 6841,  482, 7441, 1235, 
+  2126, 4742, 2802, 5744, 6287, 4933,  699, 3604, 1297, 2127, 5857, 1705, 3868, 3779, 4397, 2177, 
+   159,  622, 2240, 1275,  640, 6948, 4572, 5277,  209, 2605, 1157, 7328, 5817, 3191, 1662, 2009, 
+  4864,  574, 2487,  164, 6197, 4436, 7257, 3462, 4268, 4281, 3414, 4515, 3170, 1290, 2003, 5855, 
+  7156, 6062, 7531, 1732, 3249, 4884, 7512, 3590, 1049, 2123, 1397, 6093, 3691, 6130, 6541, 3946, 
+  6258, 3322, 1788, 4241, 4900, 2309, 1400, 1757,  400,  502, 6698, 2338, 3011,  668, 7444, 4580, 
+  6516, 6795, 2959, 4136, 3040, 2279, 6355, 3943, 2913, 6613, 7416, 4084, 6508, 5556, 4054, 3782, 
+    61, 6567, 2212,  779,  632, 5709, 5667, 4923, 4911, 6893, 4695, 4164, 3536, 2287, 7594, 2848, 
+  3267, 1911, 3128,  546, 1991,  156, 4958, 5531, 6903,  483,  875,  138,  250, 2234, 2266, 7222, 
+  2842, 4258,  812, 6703,  232, 5207, 6650, 2585, 1900, 6225, 4932, 7265, 4701, 3173, 4635, 6393, 
+   227, 7313, 4454, 4284, 6759, 1224, 5223, 1447,  395, 2608, 4502, 4037,  189, 3348,   54, 6443, 
+  2210, 6230, 2826, 1780, 3002, 5995, 1955, 6102, 6045, 3938, 5019, 4417, 1434, 1262, 1507, 5847, 
+  5917, 7157, 7177, 6434, 7537,  741, 4348, 1309,  145,  374, 2236, 4496, 5028, 6771, 6923, 7421, 
+  1978, 1023, 3857, 6876, 1102, 7451, 4704, 6518, 1344,  765,  384, 5705, 1207, 1630, 4734, 1563, 
+  6839, 5933, 1954, 4987, 7142, 5814, 7527, 4953, 7637, 4707, 2182, 5734, 2818,  541, 4097, 5641};
+

crypto_kem/kyber768/clean/reduce.c

@@ -0,0 +1,73 @@
+#include "reduce.h"
+#include "params.h"
+
+
+static const uint32_t qinv = 7679; // -inverse_mod(q,2^18)
+static const uint32_t rlog = 18;
+
+/*************************************************
+* Name:        montgomery_reduce
+* 
+* Description: Montgomery reduction; given a 32-bit integer a, computes
+*              16-bit integer congruent to a * R^-1 mod q, 
+*              where R=2^18 (see value of rlog)
+*
+* Arguments:   - uint32_t a: input unsigned integer to be reduced; has to be in {0,...,2281446912}
+*              
+* Returns:     unsigned integer in {0,...,2^13-1} congruent to a * R^-1 modulo q.
+**************************************************/
+uint16_t montgomery_reduce(uint32_t a)
+{
+  uint32_t u;
+
+  u = (a * qinv);
+  u &= ((1<<rlog)-1);
+  u *= KYBER_Q;
+  a = a + u;
+  return a >> rlog;
+}
+
+
+/*************************************************
+* Name:        barrett_reduce
+* 
+* Description: Barrett reduction; given a 16-bit integer a, computes
+*              16-bit integer congruent to a mod q in {0,...,11768}
+*
+* Arguments:   - uint16_t a: input unsigned integer to be reduced
+*              
+* Returns:     unsigned integer in {0,...,11768} congruent to a modulo q.
+**************************************************/
+uint16_t barrett_reduce(uint16_t a)
+{
+  uint32_t u;
+
+  u = a >> 13;//((uint32_t) a * sinv) >> 16;
+  u *= KYBER_Q;
+  a -= u;
+  return a;
+}
+
+/*************************************************
+* Name:        freeze
+* 
+* Description: Full reduction; given a 16-bit integer a, computes
+*              unsigned integer a mod q.
+*
+* Arguments:   - uint16_t x: input unsigned integer to be reduced
+*              
+* Returns:     unsigned integer in {0,...,q-1} congruent to a modulo q.
+**************************************************/
+uint16_t freeze(uint16_t x)
+{
+  uint16_t m,r;
+  int16_t c;
+  r = barrett_reduce(x);
+
+  m = r - KYBER_Q;
+  c = m;
+  c >>= 15; 
+  r = m ^ ((r^m)&c); 
+
+  return r;
+}

crypto_kem/kyber768/clean/reduce.h

@@ -0,0 +1,12 @@
+#ifndef REDUCE_H
+#define REDUCE_H
+
+#include <stdint.h>
+
+uint16_t freeze(uint16_t x);
+
+uint16_t montgomery_reduce(uint32_t a);
+
+uint16_t barrett_reduce(uint16_t a);
+
+#endif

crypto_kem/kyber768/clean/verify.c

@@ -0,0 +1,48 @@
+#include <string.h>
+#include <stdint.h>
+
+/*************************************************
+* Name:        verify
+* 
+* Description: Compare two arrays for equality in constant time.
+*
+* Arguments:   const unsigned char *a: pointer to first byte array
+*              const unsigned char *b: pointer to second byte array
+*              size_t len:             length of the byte arrays
+*
+* Returns 0 if the byte arrays are equal, 1 otherwise
+**************************************************/
+int verify(const unsigned char *a, const unsigned char *b, size_t len)
+{
+  uint64_t r;
+  size_t i;
+  r = 0;
+  
+  for(i=0;i<len;i++)
+    r |= a[i] ^ b[i];
+
+  r = (-r) >> 63;
+  return r;
+}
+
+/*************************************************
+* Name:        cmov
+* 
+* Description: Copy len bytes from x to r if b is 1;
+*              don't modify x if b is 0. Requires b to be in {0,1};
+*              assumes two's complement representation of negative integers.
+*              Runs in constant time.
+*
+* Arguments:   unsigned char *r:       pointer to output byte array
+*              const unsigned char *x: pointer to input byte array
+*              size_t len:             Amount of bytes to be copied
+*              unsigned char b:        Condition bit; has to be in {0,1}
+**************************************************/
+void cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b)
+{
+  size_t i;
+
+  b = -b;
+  for(i=0;i<len;i++)
+    r[i] ^= b & (x[i] ^ r[i]);
+}

crypto_kem/kyber768/clean/verify.h

@@ -0,0 +1,10 @@
+#ifndef VERIFY_H
+#define VERIFY_H
+
+#include <stdio.h>
+
+int verify(const unsigned char *a, const unsigned char *b, size_t len);
+
+void cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b);
+
+#endif

crypto_kem/test.c

@@ -0,0 +1,109 @@
+#include "api.h"
+#include "randombytes.h"
+#include <stdio.h>
+#include <string.h>
+
+#define NTESTS 10000
+
+int test_keys()
+{
+  unsigned char key_a[CRYPTO_BYTES], key_b[CRYPTO_BYTES];
+  unsigned char pk[CRYPTO_PUBLICKEYBYTES];
+  unsigned char sendb[CRYPTO_CIPHERTEXTBYTES];
+  unsigned char sk_a[CRYPTO_SECRETKEYBYTES];
+  int i;
+
+  for(i=0; i<NTESTS; i++)
+  {
+    //Alice generates a public key
+    crypto_kem_keypair(pk, sk_a);
+
+    //Bob derives a secret key and creates a response
+    crypto_kem_enc(sendb, key_b, pk);
+
+    //Alice uses Bobs response to get her secret key
+    crypto_kem_dec(key_a, sendb, sk_a);
+
+    if(memcmp(key_a, key_b, CRYPTO_BYTES))
+      printf("ERROR keys\n");
+  }
+
+  return 0;
+}
+
+
+int test_invalid_sk_a()
+{
+  unsigned char sk_a[CRYPTO_SECRETKEYBYTES];
+  unsigned char key_a[CRYPTO_BYTES], key_b[CRYPTO_BYTES];
+  unsigned char pk[CRYPTO_PUBLICKEYBYTES];
+  unsigned char sendb[CRYPTO_CIPHERTEXTBYTES];
+  int i;
+
+  for(i=0; i<NTESTS; i++)
+  {
+    //Alice generates a public key
+    crypto_kem_keypair(pk, sk_a);
+
+    //Bob derives a secret key and creates a response
+    crypto_kem_enc(sendb, key_b, pk);
+
+    //Replace secret key with random values
+    randombytes(sk_a, CRYPTO_SECRETKEYBYTES);
+
+
+    //Alice uses Bobs response to get her secre key
+    crypto_kem_dec(key_a, sendb, sk_a);
+
+    if(!memcmp(key_a, key_b, CRYPTO_BYTES))
+      printf("ERROR invalid sk_a\n");
+  }
+
+  return 0;
+}
+
+
+int test_invalid_ciphertext()
+{
+  unsigned char sk_a[CRYPTO_SECRETKEYBYTES];
+  unsigned char key_a[CRYPTO_BYTES], key_b[CRYPTO_BYTES];
+  unsigned char pk[CRYPTO_PUBLICKEYBYTES];
+  unsigned char sendb[CRYPTO_CIPHERTEXTBYTES];
+  int i;
+  size_t pos;
+
+  for(i=0; i<NTESTS; i++)
+  {
+    randombytes((unsigned char *)&pos, sizeof(size_t));
+
+    //Alice generates a public key
+    crypto_kem_keypair(pk, sk_a);
+
+    //Bob derives a secret key and creates a response
+    crypto_kem_enc(sendb, key_b, pk);
+
+    //Change some byte in the ciphertext (i.e., encapsulated key)
+    sendb[pos % CRYPTO_CIPHERTEXTBYTES] ^= 23;
+
+    //Alice uses Bobs response to get her secre key
+    crypto_kem_dec(key_a, sendb, sk_a);
+
+    if(!memcmp(key_a, key_b, CRYPTO_BYTES))
+      printf("ERROR invalid ciphertext\n");
+  }
+
+  return 0;
+}
+
+int main(void)
+{
+  test_keys();
+  test_invalid_sk_a();
+  test_invalid_ciphertext();
+
+  printf("CRYPTO_SECRETKEYBYTES:  %d\n",CRYPTO_SECRETKEYBYTES);
+  printf("CRYPTO_PUBLICKEYBYTES:  %d\n",CRYPTO_PUBLICKEYBYTES);
+  printf("CRYPTO_CIPHERTEXTBYTES: %d\n",CRYPTO_CIPHERTEXTBYTES);
+
+  return 0;
+}