Dilithium 3.1 (#25)

* Dilithium 3.1

* KAT testing
* Incluide AARCH64 implementation
* Add test for Z packing/unpacking

.github/workflows/main.yml

@@ -83,9 +83,9 @@ jobs:
       - name: Run KAT tests
         run: |
           cd test/katrunner &&
-          wget http://amongbytes.com/files/kat.zip
+          wget http://www.amongbytes.com/files/kat.zip
           unzip kat.zip
-          cargo run --release -- --katdir kat
+          cargo run --release -- --katdir KAT
   MEMSAN:
     name: Memory Sanitizer build
     runs-on: [ubuntu-20.04]

src/rustapi/pqc-sys/Cargo.lock

@@ -1,351 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-[[package]]
-name = "aho-corasick"
-version = "0.7.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7404febffaa47dac81aa44dba71523c9d069b1bdc50a77db41195149e17f68e5"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "ansi_term"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee49baf6cb617b853aa8d93bf420db2383fab46d314482ca2803b40d5fde979b"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "bindgen"
-version = "0.56.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2da379dbebc0b76ef63ca68d8fc6e71c0f13e59432e0987e508c1820e6ab5239"
-dependencies = [
- "bitflags",
- "cexpr",
- "clang-sys",
- "clap",
- "env_logger",
- "lazy_static",
- "lazycell",
- "log",
- "peeking_take_while",
- "proc-macro2",
- "quote",
- "regex",
- "rustc-hash",
- "shlex",
- "which",
-]
-
-[[package]]
-name = "bitflags"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
-
-[[package]]
-name = "cc"
-version = "1.0.67"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3c69b077ad434294d3ce9f1f6143a2a4b89a8a2d54ef813d85003a4fd1137fd"
-
-[[package]]
-name = "cexpr"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4aedb84272dbe89af497cf81375129abda4fc0a9e7c5d317498c15cc30c0d27"
-dependencies = [
- "nom",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "clang-sys"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f54d78e30b388d4815220c8dd03fea5656b6c6d32adb59e89061552a102f8da1"
-dependencies = [
- "glob",
- "libc",
- "libloading",
-]
-
-[[package]]
-name = "clap"
-version = "2.33.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37e58ac78573c40708d45522f0d80fa2f01cc4f9b4e2bf749807255454312002"
-dependencies = [
- "ansi_term",
- "atty",
- "bitflags",
- "strsim",
- "textwrap",
- "unicode-width",
- "vec_map",
-]
-
-[[package]]
-name = "cmake"
-version = "0.1.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb6210b637171dfba4cda12e579ac6dc73f5165ad56133e5d72ef3131f320855"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "env_logger"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17392a012ea30ef05a610aa97dfb49496e71c9f676b27879922ea5bdf60d9d3f"
-dependencies = [
- "atty",
- "humantime",
- "log",
- "regex",
- "termcolor",
-]
-
-[[package]]
-name = "glob"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b919933a397b79c37e33b77bb2aa3dc8eb6e165ad809e58ff75bc7db2e34574"
-
-[[package]]
-name = "hermit-abi"
-version = "0.1.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "322f4de77956e22ed0e5032c359a0f1273f1f7f0d79bfa3b8ffbc730d7fbcc5c"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "humantime"
-version = "2.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "lazycell"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
-
-[[package]]
-name = "libc"
-version = "0.2.91"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8916b1f6ca17130ec6568feccee27c156ad12037880833a3b842a823236502e7"
-
-[[package]]
-name = "libloading"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f84d96438c15fcd6c3f244c8fce01d1e2b9c6b5623e9c711dc9286d8fc92d6a"
-dependencies = [
- "cfg-if",
- "winapi",
-]
-
-[[package]]
-name = "log"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "memchr"
-version = "2.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ee1c47aaa256ecabcaea351eae4a9b01ef39ed810004e298d2511ed284b1525"
-
-[[package]]
-name = "nom"
-version = "5.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffb4262d26ed83a1c0a33a38fe2bb15797329c85770da05e6b828ddb782627af"
-dependencies = [
- "memchr",
- "version_check",
-]
-
-[[package]]
-name = "peeking_take_while"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
-
-[[package]]
-name = "pqc-sys"
-version = "0.1.0"
-dependencies = [
- "bindgen",
- "cmake",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e0704ee1a7e00d7bb417d0770ea303c1bccbabf0ef1667dae92b5967f5f8a71"
-dependencies = [
- "unicode-xid",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "regex"
-version = "1.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "957056ecddbeba1b26965114e191d2e8589ce74db242b6ea25fc4062427a5c19"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.6.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5f089152e60f62d28b835fbff2cd2e8dc0baf1ac13343bef92ab7eed84548"
-
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
-[[package]]
-name = "shlex"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fdf1b9db47230893d76faad238fd6097fd6d6a9245cd7a4d90dbd639536bbd2"
-
-[[package]]
-name = "strsim"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
-
-[[package]]
-name = "termcolor"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dfed899f0eb03f32ee8c6a0aabdb8a7949659e3466561fc0adf54e26d88c5f4"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "textwrap"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
-dependencies = [
- "unicode-width",
-]
-
-[[package]]
-name = "unicode-width"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9337591893a19b88d8d87f2cec1e73fad5cdfd10e5a6f349f498ad6ea2ffb1e3"
-
-[[package]]
-name = "unicode-xid"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7fe0bb3479651439c9112f72b6c505038574c9fbb575ed1bf3b797fa39dd564"
-
-[[package]]
-name = "vec_map"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
-
-[[package]]
-name = "version_check"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fecdca9a5291cc2b8dcf7dc02453fee791a280f3743cb0905f8822ae463b3fe"
-
-[[package]]
-name = "which"
-version = "3.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d011071ae14a2f6671d0b74080ae0cd8ebf3a6f8c9589a2cd45f23126fe29724"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

src/rustapi/pqc-sys/src/bindings.rs

@@ -17,6 +17,10 @@ pub const __USE_POSIX199506: u32 = 1;
 pub const __USE_XOPEN2K: u32 = 1;
 pub const __USE_XOPEN2K8: u32 = 1;
 pub const _ATFILE_SOURCE: u32 = 1;
+pub const __WORDSIZE: u32 = 64;
+pub const __WORDSIZE_TIME64_COMPAT32: u32 = 1;
+pub const __SYSCALL_WORDSIZE: u32 = 64;
+pub const __TIMESIZE: u32 = 64;
 pub const __USE_MISC: u32 = 1;
 pub const __USE_ATFILE: u32 = 1;
 pub const __USE_FORTIFY_LEVEL: u32 = 0;
@@ -24,31 +28,31 @@ pub const __GLIBC_USE_DEPRECATED_GETS: u32 = 0;
 pub const __GLIBC_USE_DEPRECATED_SCANF: u32 = 0;
 pub const _STDC_PREDEF_H: u32 = 1;
 pub const __STDC_IEC_559__: u32 = 1;
+pub const __STDC_IEC_60559_BFP__: u32 = 201404;
 pub const __STDC_IEC_559_COMPLEX__: u32 = 1;
+pub const __STDC_IEC_60559_COMPLEX__: u32 = 201404;
 pub const __STDC_ISO_10646__: u32 = 201706;
 pub const __GNU_LIBRARY__: u32 = 6;
 pub const __GLIBC__: u32 = 2;
-pub const __GLIBC_MINOR__: u32 = 31;
+pub const __GLIBC_MINOR__: u32 = 35;
 pub const _SYS_CDEFS_H: u32 = 1;
 pub const __glibc_c99_flexarr_available: u32 = 1;
-pub const __WORDSIZE: u32 = 64;
-pub const __WORDSIZE_TIME64_COMPAT32: u32 = 1;
-pub const __SYSCALL_WORDSIZE: u32 = 64;
-pub const __LONG_DOUBLE_USES_FLOAT128: u32 = 0;
+pub const __LDOUBLE_REDIRECTS_TO_FLOAT128_ABI: u32 = 0;
 pub const __HAVE_GENERIC_SELECTION: u32 = 1;
 pub const __GLIBC_USE_LIB_EXT2: u32 = 0;
 pub const __GLIBC_USE_IEC_60559_BFP_EXT: u32 = 0;
 pub const __GLIBC_USE_IEC_60559_BFP_EXT_C2X: u32 = 0;
+pub const __GLIBC_USE_IEC_60559_EXT: u32 = 0;
 pub const __GLIBC_USE_IEC_60559_FUNCS_EXT: u32 = 0;
 pub const __GLIBC_USE_IEC_60559_FUNCS_EXT_C2X: u32 = 0;
 pub const __GLIBC_USE_IEC_60559_TYPES_EXT: u32 = 0;
 pub const _BITS_TYPES_H: u32 = 1;
-pub const __TIMESIZE: u32 = 64;
 pub const _BITS_TYPESIZES_H: u32 = 1;
 pub const __OFF_T_MATCHES_OFF64_T: u32 = 1;
 pub const __INO_T_MATCHES_INO64_T: u32 = 1;
 pub const __RLIM_T_MATCHES_RLIM64_T: u32 = 1;
 pub const __STATFS_MATCHES_STATFS64: u32 = 1;
+pub const __KERNEL_OLD_TIMEVAL_MATCHES_TIMEVAL64: u32 = 1;
 pub const __FD_SETSIZE: u32 = 1024;
 pub const _BITS_TIME64_H: u32 = 1;
 pub const _BITS_WCHAR_H: u32 = 1;
@@ -163,6 +167,7 @@ pub type __id_t = ::std::os::raw::c_uint;
 pub type __time_t = ::std::os::raw::c_long;
 pub type __useconds_t = ::std::os::raw::c_uint;
 pub type __suseconds_t = ::std::os::raw::c_long;
+pub type __suseconds64_t = ::std::os::raw::c_long;
 pub type __daddr_t = ::std::os::raw::c_int;
 pub type __key_t = ::std::os::raw::c_int;
 pub type __clockid_t = ::std::os::raw::c_int;
@@ -238,18 +243,17 @@ pub const PQC_ALG_KEM_KYBER1024: ::std::os::raw::c_uint = 2;
 pub const PQC_ALG_KEM_HQCRMRS128: ::std::os::raw::c_uint = 3;
 pub const PQC_ALG_KEM_HQCRMRS192: ::std::os::raw::c_uint = 4;
 pub const PQC_ALG_KEM_HQCRMRS256: ::std::os::raw::c_uint = 5;
-pub const PQC_ALG_KEM_SIKE434: ::std::os::raw::c_uint = 6;
-pub const PQC_ALG_KEM_MCELIECE348864: ::std::os::raw::c_uint = 7;
-pub const PQC_ALG_KEM_MCELIECE460896: ::std::os::raw::c_uint = 8;
-pub const PQC_ALG_KEM_MCELIECE6688128: ::std::os::raw::c_uint = 9;
-pub const PQC_ALG_KEM_MCELIECE6960119: ::std::os::raw::c_uint = 10;
-pub const PQC_ALG_KEM_MCELIECE8192128: ::std::os::raw::c_uint = 11;
-pub const PQC_ALG_KEM_MCELIECE348864F: ::std::os::raw::c_uint = 12;
-pub const PQC_ALG_KEM_MCELIECE460896F: ::std::os::raw::c_uint = 13;
-pub const PQC_ALG_KEM_MCELIECE6688128F: ::std::os::raw::c_uint = 14;
-pub const PQC_ALG_KEM_MCELIECE6960119F: ::std::os::raw::c_uint = 15;
-pub const PQC_ALG_KEM_MCELIECE8192128F: ::std::os::raw::c_uint = 16;
-pub const PQC_ALG_KEM_MAX: ::std::os::raw::c_uint = 17;
+pub const PQC_ALG_KEM_MCELIECE348864: ::std::os::raw::c_uint = 6;
+pub const PQC_ALG_KEM_MCELIECE460896: ::std::os::raw::c_uint = 7;
+pub const PQC_ALG_KEM_MCELIECE6688128: ::std::os::raw::c_uint = 8;
+pub const PQC_ALG_KEM_MCELIECE6960119: ::std::os::raw::c_uint = 9;
+pub const PQC_ALG_KEM_MCELIECE8192128: ::std::os::raw::c_uint = 10;
+pub const PQC_ALG_KEM_MCELIECE348864F: ::std::os::raw::c_uint = 11;
+pub const PQC_ALG_KEM_MCELIECE460896F: ::std::os::raw::c_uint = 12;
+pub const PQC_ALG_KEM_MCELIECE6688128F: ::std::os::raw::c_uint = 13;
+pub const PQC_ALG_KEM_MCELIECE6960119F: ::std::os::raw::c_uint = 14;
+pub const PQC_ALG_KEM_MCELIECE8192128F: ::std::os::raw::c_uint = 15;
+pub const PQC_ALG_KEM_MAX: ::std::os::raw::c_uint = 16;
 pub type _bindgen_ty_2 = ::std::os::raw::c_uint;
 #[repr(C)]
 #[derive(Debug, Copy, Clone)]

src/sign/dilithium/dilithium2/aarch64/LICENSE

@@ -0,0 +1,121 @@
+Creative Commons Legal Code
+
+CC0 1.0 Universal
+
+    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+    HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without fear
+of later claims of infringement build upon, modify, incorporate in other
+works, reuse and redistribute as freely as possible in any form whatsoever
+and for any purposes, including without limitation commercial purposes.
+These owners may contribute to the Commons to promote the ideal of a free
+culture and the further production of creative, cultural and scientific
+works, or to gain reputation or greater distribution for their Work in
+part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under its
+terms, with knowledge of his or her Copyright and Related Rights in the
+Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be
+protected by copyright and related or neighboring rights ("Copyright and
+Related Rights"). Copyright and Related Rights include, but are not
+limited to, the following:
+
+  i. the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+ ii. moral rights retained by the original author(s) and/or performer(s);
+iii. publicity and privacy rights pertaining to a person's image or
+     likeness depicted in a Work;
+ iv. rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+  v. rights protecting the extraction, dissemination, use and reuse of data
+     in a Work;
+ vi. database rights (such as those arising under Directive 96/9/EC of the
+     European Parliament and of the Council of 11 March 1996 on the legal
+     protection of databases, and under any national implementation
+     thereof, including any amended or successor version of such
+     directive); and
+vii. other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention
+of, applicable law, Affirmer hereby overtly, fully, permanently,
+irrevocably and unconditionally waives, abandons, and surrenders all of
+Affirmer's Copyright and Related Rights and associated claims and causes
+of action, whether now known or unknown (including existing as well as
+future claims and causes of action), in the Work (i) in all territories
+worldwide, (ii) for the maximum duration provided by applicable law or
+treaty (including future time extensions), (iii) in any current or future
+medium and for any number of copies, and (iv) for any purpose whatsoever,
+including without limitation commercial, advertising or promotional
+purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+member of the public at large and to the detriment of Affirmer's heirs and
+successors, fully intending that such Waiver shall not be subject to
+revocation, rescission, cancellation, termination, or any other legal or
+equitable action to disrupt the quiet enjoyment of the Work by the public
+as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason
+be judged legally invalid or ineffective under applicable law, then the
+Waiver shall be preserved to the maximum extent permitted taking into
+account Affirmer's express Statement of Purpose. In addition, to the
+extent the Waiver is so judged Affirmer hereby grants to each affected
+person a royalty-free, non transferable, non sublicensable, non exclusive,
+irrevocable and unconditional license to exercise Affirmer's Copyright and
+Related Rights in the Work (i) in all territories worldwide, (ii) for the
+maximum duration provided by applicable law or treaty (including future
+time extensions), (iii) in any current or future medium and for any number
+of copies, and (iv) for any purpose whatsoever, including without
+limitation commercial, advertising or promotional purposes (the
+"License"). The License shall be deemed effective as of the date CC0 was
+applied by Affirmer to the Work. Should any part of the License for any
+reason be judged legally invalid or ineffective under applicable law, such
+partial invalidity or ineffectiveness shall not invalidate the remainder
+of the License, and in such case Affirmer hereby affirms that he or she
+will not (i) exercise any of his or her remaining Copyright and Related
+Rights in the Work or (ii) assert any associated claims and causes of
+action with respect to the Work, in either case contrary to Affirmer's
+express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
+    surrendered, licensed or otherwise affected by this document.
+ b. Affirmer offers the Work as-is and makes no representations or
+    warranties of any kind concerning the Work, express, implied,
+    statutory or otherwise, including without limitation warranties of
+    title, merchantability, fitness for a particular purpose, non
+    infringement, or the absence of latent or other defects, accuracy, or
+    the present or absence of errors, whether or not discoverable, all to
+    the greatest extent permissible under applicable law.
+ c. Affirmer disclaims responsibility for clearing rights of other persons
+    that may apply to the Work or any use thereof, including without
+    limitation any person's Copyright and Related Rights in the Work.
+    Further, Affirmer disclaims responsibility for obtaining any necessary
+    consents, permissions or other rights required for any use of the
+    Work.
+ d. Affirmer understands and acknowledges that Creative Commons is not a
+    party to this document and has no duty or obligation with respect to
+    this CC0 or use of the Work.

src/sign/dilithium/dilithium2/aarch64/Makefile

@@ -0,0 +1,23 @@
+# This Makefile can be used with GNU Make or BSD Make
+
+LIB=libdilithium2_aarch64.a
+HEADERS=api.h fips202x2.h macros_common.inc macros.inc NTT_params.h ntt.h packing.h params.h poly.h polyvec.h reduce.h rounding.h sign.h symmetric.h
+OBJECTS=fips202x2.o ntt.o packing.o poly.o polyvec.o reduce.o rounding.o sign.o symmetric-shake.o __asm_iNTT.o __asm_NTT.o __asm_poly.o
+
+
+CFLAGS=-O3 -Wall -Wextra -Wpedantic -Werror -Wmissing-prototypes -Wredundant-decls -std=c99 -I../../../common $(EXTRAFLAGS) -g
+
+all: $(LIB)
+
+%.o: %.c $(HEADERS)
+	$(CC) $(CFLAGS) -c -o $@ $<
+
+%.o: %.S $(HEADERS)
+	$(CC) $(CFLAGS) -c -o $@ $<
+
+$(LIB): $(OBJECTS) $(HEADERS)
+	$(AR) -r $@ $(OBJECTS)
+
+clean:
+	$(RM) $(OBJECTS)
+	$(RM) $(LIB)

src/sign/dilithium/dilithium2/aarch64/NTT_params.h

@@ -0,0 +1,56 @@
+#ifndef NTT_PARAMS_H
+#define NTT_PARAMS_H
+
+#define ARRAY_N 256
+
+#define NTT_N 256
+#define LOGNTT_N 8
+
+// root of unity: 1753
+
+
+// Q1
+#define Q1 8380417
+// omegaQ1 = 1753 mod Q1
+#define omegaQ1 1753
+// invomegaQ1 = omegaQ^{-1} mod Q1
+#define invomegaQ1 731434
+// R = 2^32 below
+// RmodQ1 = 2^32 mod^{+-} Q1
+#define RmodQ1 (-4186625)
+// Q1prime = Q1^{-1} mod^{+-} 2^32
+#define Q1prime 58728449
+// invNQ1 = NTT_N^{-1} mod Q1
+#define invNQ1 8347681
+
+// invNQ1R2modQ1 = -NTT_N^{-1} 2^32 2^32 mod^{+-} Q1 below
+#define invNQ1R2modQ1 (-41978)
+// invNQ1R2modQ1_prime = invNQ1R2modQ1 (Q1^{-1} mod^{+-} 2^32) mod^{+-} 2^32
+#define invNQ1R2modQ1_prime 8395782
+// invNQ1R2modQ1_prime_half = (invNQ1R2modQ1 / 2) (Q1^{-1} mod^{+-} 2^32) mod^{+-} 2^32
+#define invNQ1R2modQ1_prime_half 4197891
+// invNQ1R2modQ1_doubleprime = (invNQ1R2modQ1_prime Q1 - invNQ1R2modQ1) / 2^32
+#define invNQ1R2modQ1_doubleprime 16382
+
+// invNQ1_final_R2modQ1 = -invNQ1R2modQ1 invomegaQ1^{128} mod q
+#define invNQ1_final_R2modQ1 4404704
+// invNQ1_final_R2modQ1_prime = invNQ1_final_R2modQ1 (Q1^{-1} mod^{+-} 2^32) mod^{+-} 2^32
+#define invNQ1_final_R2modQ1_prime (-151046688)
+// invNQ1_final_R2modQ1_prime_half = (invNQ1_final_R2modQ1 / 2) (Q1^{-1} mod^{+-} 2^32) mod^{+-} 2^32
+#define invNQ1_final_R2modQ1_prime_half (-75523344)
+// invNQ1_final_R2modQ1_doubleprime = (invNQ1_final_R2modQ1_prime Q1 - invNQ1_final_R2modQ1) / 2^32
+#define invNQ1_final_R2modQ1_doubleprime (-294725)
+
+// RmodQ1_prime = -(RmodQ1 + Q1) Q1prime mod^{+-} 2^32
+#define RmodQ1_prime 512
+// RmodQ1_prime_half = ( -(RmodQ1 + Q1) / 2) Q1prime mod^{+-} 2^32
+#define RmodQ1_prime_half 256
+// RmodQ1_doubleprime = (RmodQ1_prime Q1 - RmodQ1_prime ) / 2^32
+#define RmodQ1_doubleprime 1
+
+#endif
+
+
+
+
+

src/sign/dilithium/dilithium2/aarch64/__asm_NTT.S

@@ -0,0 +1,274 @@
+
+#include "macros.inc"
+
+.align 2
+.global PQCLEAN_DILITHIUM2_AARCH64_asm_ntt_SIMD_top
+.global _PQCLEAN_DILITHIUM2_AARCH64_asm_ntt_SIMD_top
+#ifndef __clang__
+.type PQCLEAN_DILITHIUM2_AARCH64_asm_ntt_SIMD_top, %function
+#endif
+PQCLEAN_DILITHIUM2_AARCH64_asm_ntt_SIMD_top:
+_PQCLEAN_DILITHIUM2_AARCH64_asm_ntt_SIMD_top:
+
+    push_all
+    Q         .req w20
+    src0      .req x0
+    src1      .req x1
+    src2      .req x2
+    src3      .req x3
+    src4      .req x4
+    src5      .req x5
+    src6      .req x6
+    src7      .req x7
+    src8      .req x8
+    src9      .req x9
+    src10     .req x10
+    src11     .req x11
+    src12     .req x12
+    src13     .req x13
+    src14     .req x14
+    src15     .req x15
+    table     .req x28
+    counter   .req x19
+
+    ldr Q, [x2]
+
+    mov table, x1
+
+    add  src1, src0, #64
+    add  src2, src0, #128
+
+    add  src3, src0, #192
+    add  src4, src0, #256
+
+    add  src5, src0, #320
+    add  src6, src0, #384
+
+    add  src7, src0, #448
+    add  src8, src0, #512
+
+    add  src9, src0, #576
+    add src10, src0, #640
+
+    add src11, src0, #704
+    add src12, src0, #768
+
+    add src13, src0, #832
+    add src14, src0, #896
+
+    add src15, src0, #960
+
+    ld1 {v20.4S, v21.4S, v22.4S, v23.4S}, [table], #64
+    ld1 {v24.4S, v25.4S, v26.4S, v27.4S}, [table], #64
+
+    mov v20.S[0], Q
+
+    ld1 { v1.4S}, [ src1]
+    ld1 { v3.4S}, [ src3]
+    ld1 { v5.4S}, [ src5]
+    ld1 { v7.4S}, [ src7]
+    ld1 { v9.4S}, [ src9]
+    ld1 {v11.4S}, [src11]
+    ld1 {v13.4S}, [src13]
+    ld1 {v15.4S}, [src15]
+
+    ld1 { v0.4S}, [ src0]
+    ld1 { v2.4S}, [ src2]
+    ld1 { v4.4S}, [ src4]
+    ld1 { v6.4S}, [ src6]
+    ld1 { v8.4S}, [ src8]
+    ld1 {v10.4S}, [src10]
+    ld1 {v12.4S}, [src12]
+    ld1 {v14.4S}, [src14]
+
+    qq_butterfly_top  v1,  v3,  v5,  v7,  v9, v11, v13, v15, v16, v17, v18, v19, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_butterfly_mixed  v1,  v3,  v5,  v7,  v9, v11, v13, v15, v16, v17, v18, v19,  v0,  v2,  v4,  v6,  v8, v10, v12, v14, v28, v29, v30, v31, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_butterfly_mixed  v0,  v2,  v4,  v6,  v8, v10, v12, v14, v28, v29, v30, v31,  v1,  v3,  v9, v11,  v5,  v7, v13, v15, v16, v17, v18, v19, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3
+    qq_butterfly_mixed  v1,  v3,  v9, v11,  v5,  v7, v13, v15, v16, v17, v18, v19,  v0,  v2,  v8, v10,  v4,  v6, v12, v14, v28, v29, v30, v31, v20, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3
+    qq_butterfly_mixed  v0,  v2,  v8, v10,  v4,  v6, v12, v14, v28, v29, v30, v31,  v1,  v5,  v9, v13,  v3,  v7, v11, v15, v16, v17, v18, v19, v20, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3
+    qq_butterfly_mixed  v1,  v5,  v9, v13,  v3,  v7, v11, v15, v16, v17, v18, v19,  v0,  v4,  v8, v12,  v2,  v6, v10, v14, v28, v29, v30, v31, v20, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3
+    qq_butterfly_mixed  v0,  v4,  v8, v12,  v2,  v6, v10, v14, v28, v29, v30, v31,  v0,  v2,  v4,  v6,  v1,  v3,  v5,  v7, v16, v17, v18, v19, v20, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3, v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3
+    qq_butterfly_mixed  v0,  v2,  v4,  v6,  v1,  v3,  v5,  v7, v16, v17, v18, v19,  v8, v10, v12, v14,  v9, v11, v13, v15, v28, v29, v30, v31, v20,  v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3
+    qq_butterfly_bot  v8, v10, v12, v14,  v9, v11, v13, v15, v28, v29, v30, v31, v20, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3
+
+    mov counter, #3
+    _ntt_top_loop:
+
+    st1 { v1.4S}, [ src1], #16
+    ld1 { v1.4S}, [ src1]
+    st1 { v3.4S}, [ src3], #16
+    ld1 { v3.4S}, [ src3]
+    st1 { v5.4S}, [ src5], #16
+    ld1 { v5.4S}, [ src5]
+    st1 { v7.4S}, [ src7], #16
+    ld1 { v7.4S}, [ src7]
+    st1 { v9.4S}, [ src9], #16
+    ld1 { v9.4S}, [ src9]
+    st1 {v11.4S}, [src11], #16
+    ld1 {v11.4S}, [src11]
+    st1 {v13.4S}, [src13], #16
+    ld1 {v13.4S}, [src13]
+    st1 {v15.4S}, [src15], #16
+    ld1 {v15.4S}, [src15]
+
+    st1 { v0.4S}, [ src0], #16
+    ld1 { v0.4S}, [ src0]
+    st1 { v2.4S}, [ src2], #16
+    ld1 { v2.4S}, [ src2]
+    st1 { v4.4S}, [ src4], #16
+    ld1 { v4.4S}, [ src4]
+    st1 { v6.4S}, [ src6], #16
+    ld1 { v6.4S}, [ src6]
+    st1 { v8.4S}, [ src8], #16
+    ld1 { v8.4S}, [ src8]
+    st1 {v10.4S}, [src10], #16
+    ld1 {v10.4S}, [src10]
+    st1 {v12.4S}, [src12], #16
+    ld1 {v12.4S}, [src12]
+    st1 {v14.4S}, [src14], #16
+    ld1 {v14.4S}, [src14]
+
+    qq_butterfly_top  v1,  v3,  v5,  v7,  v9, v11, v13, v15, v16, v17, v18, v19, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_butterfly_mixed  v1,  v3,  v5,  v7,  v9, v11, v13, v15, v16, v17, v18, v19,  v0,  v2,  v4,  v6,  v8, v10, v12, v14, v28, v29, v30, v31, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_butterfly_mixed  v0,  v2,  v4,  v6,  v8, v10, v12, v14, v28, v29, v30, v31,  v1,  v3,  v9, v11,  v5,  v7, v13, v15, v16, v17, v18, v19, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3
+    qq_butterfly_mixed  v1,  v3,  v9, v11,  v5,  v7, v13, v15, v16, v17, v18, v19,  v0,  v2,  v8, v10,  v4,  v6, v12, v14, v28, v29, v30, v31, v20, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3
+    qq_butterfly_mixed  v0,  v2,  v8, v10,  v4,  v6, v12, v14, v28, v29, v30, v31,  v1,  v5,  v9, v13,  v3,  v7, v11, v15, v16, v17, v18, v19, v20, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3
+    qq_butterfly_mixed  v1,  v5,  v9, v13,  v3,  v7, v11, v15, v16, v17, v18, v19,  v0,  v4,  v8, v12,  v2,  v6, v10, v14, v28, v29, v30, v31, v20, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3
+    qq_butterfly_mixed  v0,  v4,  v8, v12,  v2,  v6, v10, v14, v28, v29, v30, v31,  v0,  v2,  v4,  v6,  v1,  v3,  v5,  v7, v16, v17, v18, v19, v20, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3, v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3
+    qq_butterfly_mixed  v0,  v2,  v4,  v6,  v1,  v3,  v5,  v7, v16, v17, v18, v19,  v8, v10, v12, v14,  v9, v11, v13, v15, v28, v29, v30, v31, v20,  v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3
+    qq_butterfly_bot  v8, v10, v12, v14,  v9, v11, v13, v15, v28, v29, v30, v31, v20, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3
+
+    sub counter, counter, #1
+    cbnz counter, _ntt_top_loop
+
+    st1 { v1.4S}, [ src1], #16
+    st1 { v3.4S}, [ src3], #16
+    st1 { v5.4S}, [ src5], #16
+    st1 { v7.4S}, [ src7], #16
+    st1 { v9.4S}, [ src9], #16
+    st1 {v11.4S}, [src11], #16
+    st1 {v13.4S}, [src13], #16
+    st1 {v15.4S}, [src15], #16
+
+    st1 { v0.4S}, [ src0], #16
+    st1 { v2.4S}, [ src2], #16
+    st1 { v4.4S}, [ src4], #16
+    st1 { v6.4S}, [ src6], #16
+    st1 { v8.4S}, [ src8], #16
+    st1 {v10.4S}, [src10], #16
+    st1 {v12.4S}, [src12], #16
+    st1 {v14.4S}, [src14], #16
+
+    .unreq    Q
+    .unreq    src0
+    .unreq    src1
+    .unreq    src2
+    .unreq    src3
+    .unreq    src4
+    .unreq    src5
+    .unreq    src6
+    .unreq    src7
+    .unreq    src8
+    .unreq    src9
+    .unreq    src10
+    .unreq    src11
+    .unreq    src12
+    .unreq    src13
+    .unreq    src14
+    .unreq    src15
+    .unreq    table
+    .unreq    counter
+    pop_all
+
+    br lr
+
+.align 2
+.global PQCLEAN_DILITHIUM2_AARCH64_asm_ntt_SIMD_bot
+.global _PQCLEAN_DILITHIUM2_AARCH64_asm_ntt_SIMD_bot
+#ifndef __clang__
+.type PQCLEAN_DILITHIUM2_AARCH64_asm_ntt_SIMD_bot, %function
+#endif
+PQCLEAN_DILITHIUM2_AARCH64_asm_ntt_SIMD_bot:
+_PQCLEAN_DILITHIUM2_AARCH64_asm_ntt_SIMD_bot:
+
+    push_all
+    Q         .req w20
+    src0      .req x0
+    des0      .req x1
+    src1      .req x2
+    des1      .req x3
+    table0    .req x28
+    table1    .req x27
+    counter   .req x19
+
+    ldr Q, [x2]
+
+    add table0, x1, #128
+    add table1, table0, #1024
+
+    add src1, src0, #512
+
+    add des0, src0, #0
+    add des1, src0, #512
+
+    mov counter, #8
+    _ntt_bot_loop:
+
+    ld1 {  v0.4S,  v1.4S,  v2.4S,  v3.4S}, [src0], #64
+    ld1 { v16.4S, v17.4S, v18.4S, v19.4S}, [src1], #64
+
+    ld1 {  v4.4S,  v5.4S}, [table0], #32
+    ld2 {  v6.4S,  v7.4S}, [table0], #32
+    ld4 {  v8.4S,  v9.4S, v10.4S, v11.4S}, [table0], #64
+    ld1 { v20.4S, v21.4S}, [table1], #32
+    ld2 { v22.4S, v23.4S}, [table1], #32
+    ld4 { v24.4S, v25.4S, v26.4S, v27.4S}, [table1], #64
+
+    mov v4.S[0], Q
+
+    dq_butterfly_top  v0,  v1,  v2,  v3, v12, v13, v4,  v4, 2, 3,  v4, 2, 3
+    dq_butterfly_mixed  v0,  v1,  v2,  v3, v12, v13, v16, v17, v18, v19, v28, v29, v4,  v4, 2, 3,  v4, 2, 3, v20, 2, 3, v20, 2, 3
+    dq_butterfly_mixed v16, v17, v18, v19, v28, v29,  v0,  v2,  v1,  v3, v12, v13, v4, v20, 2, 3, v20, 2, 3,  v5, 0, 1,  v5, 2, 3
+    dq_butterfly_mixed  v0,  v2,  v1,  v3, v12, v13, v16, v18, v17, v19, v28, v29, v4,  v5, 0, 1,  v5, 2, 3, v21, 0, 1, v21, 2, 3
+    dq_butterfly_bot v16, v18, v17, v19, v28, v29, v4, v21, 0, 1, v21, 2, 3
+
+    trn_4x4  v0,  v1,  v2,  v3, v12, v13, v14, v15
+    trn_4x4 v16, v17, v18, v19, v28, v29, v30, v31
+
+    dq_butterfly_vec_top  v0,  v1,  v2,  v3, v12, v13, v4,  v6,  v7,  v6,  v7
+    dq_butterfly_vec_mixed  v0,  v1,  v2,  v3, v12, v13, v16, v17, v18, v19, v28, v29, v4,  v6,  v7,  v6,  v7, v22, v23, v22, v23
+    dq_butterfly_vec_mixed v16, v17, v18, v19, v28, v29,  v0,  v2,  v1,  v3, v12, v13, v4, v22, v23, v22, v23,  v8,  v9, v10, v11
+    dq_butterfly_vec_mixed  v0,  v2,  v1,  v3, v12, v13, v16, v18, v17, v19, v28, v29, v4,  v8,  v9, v10, v11, v24, v25, v26, v27
+    dq_butterfly_vec_bot v16, v18, v17, v19, v28, v29, v4, v24, v25, v26, v27
+
+    st4 {  v0.4S,  v1.4S,  v2.4S,  v3.4S}, [des0], #64
+    st4 { v16.4S, v17.4S, v18.4S, v19.4S}, [des1], #64
+
+    sub counter, counter, #1
+    cbnz counter, _ntt_bot_loop
+
+    .unreq    Q
+    .unreq    src0
+    .unreq    des0
+    .unreq    src1
+    .unreq    des1
+    .unreq    table0
+    .unreq    table1
+    .unreq    counter
+    pop_all
+
+    br lr
+
+
+
+
+
+
+
+
+
+
+
+
+
+

src/sign/dilithium/dilithium2/aarch64/__asm_iNTT.S

@@ -0,0 +1,509 @@
+
+#include "macros.inc"
+
+.align 2
+.global PQCLEAN_DILITHIUM2_AARCH64_asm_intt_SIMD_top
+.global _PQCLEAN_DILITHIUM2_AARCH64_asm_intt_SIMD_top
+#ifndef __clang__
+.type PQCLEAN_DILITHIUM2_AARCH64_asm_intt_SIMD_top, %function
+#endif
+PQCLEAN_DILITHIUM2_AARCH64_asm_intt_SIMD_top:
+_PQCLEAN_DILITHIUM2_AARCH64_asm_intt_SIMD_top:
+
+    push_all
+    Q         .req w20
+    Qhalf     .req w21
+    nQhalf    .req w22
+    invNR2ph  .req w24
+    invNR2dp  .req w25
+    invNWR2ph .req w26
+    invNWR2dp .req w27
+    src0      .req  x0
+    src1      .req  x1
+    src2      .req  x2
+    src3      .req  x3
+    src4      .req  x4
+    src5      .req  x5
+    src6      .req  x6
+    src7      .req  x7
+    src8      .req  x8
+    src9      .req  x9
+    src10     .req x10
+    src11     .req x11
+    src12     .req x12
+    src13     .req x13
+    src14     .req x14
+    src15     .req x15
+    table     .req x28
+    counter   .req x19
+
+    ldr Q, [x2, #0]
+    lsr Qhalf, Q, #1
+    neg nQhalf, Qhalf
+
+    ldr invNR2ph,  [x2, #16]
+    ldr invNR2dp,  [x2, #20]
+    ldr invNWR2ph, [x2, #24]
+    ldr invNWR2dp, [x2, #28]
+
+    mov table, x1
+
+    add  src1, src0, #64
+    add  src2, src0, #128
+
+    add  src3, src0, #192
+    add  src4, src0, #256
+
+    add  src5, src0, #320
+    add  src6, src0, #384
+
+    add  src7, src0, #448
+    add  src8, src0, #512
+
+    add  src9, src0, #576
+    add src10, src0, #640
+
+    add src11, src0, #704
+    add src12, src0, #768
+
+    add src13, src0, #832
+    add src14, src0, #896
+
+    add src15, src0, #960
+
+    ld1 {v20.4S, v21.4S, v22.4S, v23.4S}, [table], #64
+    ld1 {v24.4S, v25.4S, v26.4S, v27.4S}, [table], #64
+
+    mov v20.S[0], Q
+
+    ld1 { v0.4S}, [ src0]
+    ld1 { v1.4S}, [ src1]
+    ld1 { v2.4S}, [ src2]
+    ld1 { v3.4S}, [ src3]
+    ld1 { v4.4S}, [ src4]
+    ld1 { v5.4S}, [ src5]
+    ld1 { v6.4S}, [ src6]
+    ld1 { v7.4S}, [ src7]
+
+    ld1 { v8.4S}, [ src8]
+    ld1 { v9.4S}, [ src9]
+    ld1 {v10.4S}, [src10]
+    ld1 {v11.4S}, [src11]
+    ld1 {v12.4S}, [src12]
+    ld1 {v13.4S}, [src13]
+    ld1 {v14.4S}, [src14]
+    ld1 {v15.4S}, [src15]
+
+    qq_butterfly_bot  v0,  v2,  v4,  v6, v16, v17, v18, v19,  v1,  v3,  v5,  v7, v20, v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3
+    qq_butterfly_mixed_rev  v0,  v2,  v4,  v6, v16, v17, v18, v19,  v1,  v3,  v5,  v7,  v8, v10, v12, v14, v28, v29, v30, v31,  v9, v11, v13, v15, v20, v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3
+    qq_butterfly_mixed_rev  v8, v10, v12, v14, v28, v29, v30, v31,  v9, v11, v13, v15,  v0,  v1,  v4,  v5, v16, v17, v18, v19,  v2,  v3,  v6,  v7, v20, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3, v22, 0, 1, v22, 0, 1, v22, 2, 3, v22, 2, 3
+    qq_butterfly_mixed_rev  v0,  v1,  v4,  v5, v16, v17, v18, v19,  v2,  v3,  v6,  v7,  v8,  v9, v12, v13, v28, v29, v30, v31, v10, v11, v14, v15, v20, v22, 0, 1, v22, 0, 1, v22, 2, 3, v22, 2, 3, v23, 0, 1, v23, 0, 1, v23, 2, 3, v23, 2, 3
+    qq_butterfly_mixed_rev  v8,  v9, v12, v13, v28, v29, v30, v31, v10, v11, v14, v15,  v0,  v1,  v2,  v3, v16, v17, v18, v19,  v4,  v5,  v6,  v7, v20, v23, 0, 1, v23, 0, 1, v23, 2, 3, v23, 2, 3, v21, 0, 1, v21, 0, 1, v21, 0, 1, v21, 0, 1
+    qq_butterfly_mixed_rev  v0,  v1,  v2,  v3, v16, v17, v18, v19,  v4,  v5,  v6,  v7,  v8,  v9, v10, v11, v28, v29, v30, v31, v12, v13, v14, v15, v20, v21, 0, 1, v21, 0, 1, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3, v21, 2, 3, v21, 2, 3
+    qq_butterfly_top  v8,  v9, v10, v11, v28, v29, v30, v31, v12, v13, v14, v15, v20, v21, 2, 3, v21, 2, 3, v21, 2, 3, v21, 2, 3
+
+    mov v20.S[2], invNWR2ph
+    mov v20.S[3], invNWR2dp
+
+    qq_sub_add v16, v17, v18, v19, v28, v29, v30, v31,  v0,  v2,  v4,  v6,  v8, v10, v12, v14
+    qq_sub_add  v0,  v2,  v4,  v6,  v8, v10, v12, v14,  v1,  v3,  v5,  v7,  v9, v11, v13, v15
+
+    qq_montgomery_mul  v9, v11, v13, v15,  v8, v10, v12, v14, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_montgomery_mul  v8, v10, v12, v14, v28, v29, v30, v31, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+
+    mov v20.S[2], invNR2ph
+    mov v20.S[3], invNR2dp
+
+    qq_montgomery_mul  v1,  v3,  v5,  v7,  v0,  v2,  v4,  v6, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_montgomery_mul  v0,  v2,  v4,  v6, v16, v17, v18, v19, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+
+    dup v29.4S, Q
+    dup v30.4S, Qhalf
+    dup v31.4S, nQhalf
+
+    cmge v18.4S, v31.4S,  v0.4S
+    cmge v19.4S, v31.4S,  v1.4S
+    cmge v16.4S,  v0.4S, v30.4S
+    cmge v17.4S,  v1.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v0.4S, v16.4S, v29.4S
+    mla   v1.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v2.4S
+    cmge v19.4S, v31.4S,  v3.4S
+    cmge v16.4S,  v2.4S, v30.4S
+    cmge v17.4S,  v3.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v2.4S, v16.4S, v29.4S
+    mla   v3.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v4.4S
+    cmge v19.4S, v31.4S,  v5.4S
+    cmge v16.4S,  v4.4S, v30.4S
+    cmge v17.4S,  v5.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v4.4S, v16.4S, v29.4S
+    mla   v5.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v6.4S
+    cmge v19.4S, v31.4S,  v7.4S
+    cmge v16.4S,  v6.4S, v30.4S
+    cmge v17.4S,  v7.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v6.4S, v16.4S, v29.4S
+    mla   v7.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v8.4S
+    cmge v19.4S, v31.4S,  v9.4S
+    cmge v16.4S,  v8.4S, v30.4S
+    cmge v17.4S,  v9.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v8.4S, v16.4S, v29.4S
+    mla   v9.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S, v10.4S
+    cmge v19.4S, v31.4S, v11.4S
+    cmge v16.4S, v10.4S, v30.4S
+    cmge v17.4S, v11.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla  v10.4S, v16.4S, v29.4S
+    mla  v11.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S, v12.4S
+    cmge v19.4S, v31.4S, v13.4S
+    cmge v16.4S, v12.4S, v30.4S
+    cmge v17.4S, v13.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla  v12.4S, v16.4S, v29.4S
+    mla  v13.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S, v14.4S
+    cmge v19.4S, v31.4S, v15.4S
+    cmge v16.4S, v14.4S, v30.4S
+    cmge v17.4S, v15.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla  v14.4S, v16.4S, v29.4S
+    mla  v15.4S, v17.4S, v29.4S
+
+    mov counter, #3
+    _intt_top_loop:
+
+    st1 { v0.4S}, [ src0], #16
+    ld1 { v0.4S}, [ src0]
+    st1 { v1.4S}, [ src1], #16
+    ld1 { v1.4S}, [ src1]
+    st1 { v2.4S}, [ src2], #16
+    ld1 { v2.4S}, [ src2]
+    st1 { v3.4S}, [ src3], #16
+    ld1 { v3.4S}, [ src3]
+    st1 { v4.4S}, [ src4], #16
+    ld1 { v4.4S}, [ src4]
+    st1 { v5.4S}, [ src5], #16
+    ld1 { v5.4S}, [ src5]
+    st1 { v6.4S}, [ src6], #16
+    ld1 { v6.4S}, [ src6]
+    st1 { v7.4S}, [ src7], #16
+    ld1 { v7.4S}, [ src7]
+
+    st1 { v8.4S}, [ src8], #16
+    ld1 { v8.4S}, [ src8]
+    st1 { v9.4S}, [ src9], #16
+    ld1 { v9.4S}, [ src9]
+    st1 {v10.4S}, [src10], #16
+    ld1 {v10.4S}, [src10]
+    st1 {v11.4S}, [src11], #16
+    ld1 {v11.4S}, [src11]
+    st1 {v12.4S}, [src12], #16
+    ld1 {v12.4S}, [src12]
+    st1 {v13.4S}, [src13], #16
+    ld1 {v13.4S}, [src13]
+    st1 {v14.4S}, [src14], #16
+    ld1 {v14.4S}, [src14]
+    st1 {v15.4S}, [src15], #16
+    ld1 {v15.4S}, [src15]
+
+    qq_butterfly_bot  v0,  v2,  v4,  v6, v16, v17, v18, v19,  v1,  v3,  v5,  v7, v20, v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3
+    qq_butterfly_mixed_rev  v0,  v2,  v4,  v6, v16, v17, v18, v19,  v1,  v3,  v5,  v7,  v8, v10, v12, v14, v28, v29, v30, v31,  v9, v11, v13, v15, v20, v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3
+    qq_butterfly_mixed_rev  v8, v10, v12, v14, v28, v29, v30, v31,  v9, v11, v13, v15,  v0,  v1,  v4,  v5, v16, v17, v18, v19,  v2,  v3,  v6,  v7, v20, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3, v22, 0, 1, v22, 0, 1, v22, 2, 3, v22, 2, 3
+    qq_butterfly_mixed_rev  v0,  v1,  v4,  v5, v16, v17, v18, v19,  v2,  v3,  v6,  v7,  v8,  v9, v12, v13, v28, v29, v30, v31, v10, v11, v14, v15, v20, v22, 0, 1, v22, 0, 1, v22, 2, 3, v22, 2, 3, v23, 0, 1, v23, 0, 1, v23, 2, 3, v23, 2, 3
+    qq_butterfly_mixed_rev  v8,  v9, v12, v13, v28, v29, v30, v31, v10, v11, v14, v15,  v0,  v1,  v2,  v3, v16, v17, v18, v19,  v4,  v5,  v6,  v7, v20, v23, 0, 1, v23, 0, 1, v23, 2, 3, v23, 2, 3, v21, 0, 1, v21, 0, 1, v21, 0, 1, v21, 0, 1
+    qq_butterfly_mixed_rev  v0,  v1,  v2,  v3, v16, v17, v18, v19,  v4,  v5,  v6,  v7,  v8,  v9, v10, v11, v28, v29, v30, v31, v12, v13, v14, v15, v20, v21, 0, 1, v21, 0, 1, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3, v21, 2, 3, v21, 2, 3
+    qq_butterfly_top  v8,  v9, v10, v11, v28, v29, v30, v31, v12, v13, v14, v15, v20, v21, 2, 3, v21, 2, 3, v21, 2, 3, v21, 2, 3
+
+    mov v20.S[2], invNWR2ph
+    mov v20.S[3], invNWR2dp
+
+    qq_sub_add v16, v17, v18, v19, v28, v29, v30, v31,  v0,  v2,  v4,  v6,  v8, v10, v12, v14
+    qq_sub_add  v0,  v2,  v4,  v6,  v8, v10, v12, v14,  v1,  v3,  v5,  v7,  v9, v11, v13, v15
+
+    qq_montgomery_mul  v9, v11, v13, v15,  v8, v10, v12, v14, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_montgomery_mul  v8, v10, v12, v14, v28, v29, v30, v31, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+
+    mov v20.S[2], invNR2ph
+    mov v20.S[3], invNR2dp
+
+    qq_montgomery_mul  v1,  v3,  v5,  v7,  v0,  v2,  v4,  v6, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_montgomery_mul  v0,  v2,  v4,  v6, v16, v17, v18, v19, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+
+    dup v29.4S, Q
+    dup v30.4S, Qhalf
+    dup v31.4S, nQhalf
+
+    cmge v18.4S, v31.4S,  v0.4S
+    cmge v19.4S, v31.4S,  v1.4S
+    cmge v16.4S,  v0.4S, v30.4S
+    cmge v17.4S,  v1.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v0.4S, v16.4S, v29.4S
+    mla   v1.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v2.4S
+    cmge v19.4S, v31.4S,  v3.4S
+    cmge v16.4S,  v2.4S, v30.4S
+    cmge v17.4S,  v3.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v2.4S, v16.4S, v29.4S
+    mla   v3.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v4.4S
+    cmge v19.4S, v31.4S,  v5.4S
+    cmge v16.4S,  v4.4S, v30.4S
+    cmge v17.4S,  v5.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v4.4S, v16.4S, v29.4S
+    mla   v5.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v6.4S
+    cmge v19.4S, v31.4S,  v7.4S
+    cmge v16.4S,  v6.4S, v30.4S
+    cmge v17.4S,  v7.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v6.4S, v16.4S, v29.4S
+    mla   v7.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v8.4S
+    cmge v19.4S, v31.4S,  v9.4S
+    cmge v16.4S,  v8.4S, v30.4S
+    cmge v17.4S,  v9.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v8.4S, v16.4S, v29.4S
+    mla   v9.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S, v10.4S
+    cmge v19.4S, v31.4S, v11.4S
+    cmge v16.4S, v10.4S, v30.4S
+    cmge v17.4S, v11.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla  v10.4S, v16.4S, v29.4S
+    mla  v11.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S, v12.4S
+    cmge v19.4S, v31.4S, v13.4S
+    cmge v16.4S, v12.4S, v30.4S
+    cmge v17.4S, v13.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla  v12.4S, v16.4S, v29.4S
+    mla  v13.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S, v14.4S
+    cmge v19.4S, v31.4S, v15.4S
+    cmge v16.4S, v14.4S, v30.4S
+    cmge v17.4S, v15.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla  v14.4S, v16.4S, v29.4S
+    mla  v15.4S, v17.4S, v29.4S
+
+    sub counter, counter, #1
+    cbnz counter, _intt_top_loop
+
+    st1 { v0.4S}, [ src0], #16
+    st1 { v1.4S}, [ src1], #16
+    st1 { v2.4S}, [ src2], #16
+    st1 { v3.4S}, [ src3], #16
+    st1 { v4.4S}, [ src4], #16
+    st1 { v5.4S}, [ src5], #16
+    st1 { v6.4S}, [ src6], #16
+    st1 { v7.4S}, [ src7], #16
+
+    st1 { v8.4S}, [ src8], #16
+    st1 { v9.4S}, [ src9], #16
+    st1 {v10.4S}, [src10], #16
+    st1 {v11.4S}, [src11], #16
+    st1 {v12.4S}, [src12], #16
+    st1 {v13.4S}, [src13], #16
+    st1 {v14.4S}, [src14], #16
+    st1 {v15.4S}, [src15], #16
+
+    .unreq    Q
+    .unreq    Qhalf
+    .unreq    nQhalf
+    .unreq    invNR2ph
+    .unreq    invNR2dp
+    .unreq    invNWR2ph
+    .unreq    invNWR2dp
+    .unreq    src0
+    .unreq    src1
+    .unreq    src2
+    .unreq    src3
+    .unreq    src4
+    .unreq    src5
+    .unreq    src6
+    .unreq    src7
+    .unreq    src8
+    .unreq    src9
+    .unreq    src10
+    .unreq    src11
+    .unreq    src12
+    .unreq    src13
+    .unreq    src14
+    .unreq    src15
+    .unreq    table
+    .unreq    counter
+    pop_all
+
+    br lr
+
+.align 2
+.global PQCLEAN_DILITHIUM2_AARCH64_asm_intt_SIMD_bot
+.global _PQCLEAN_DILITHIUM2_AARCH64_asm_intt_SIMD_bot
+#ifndef __clang__
+.type PQCLEAN_DILITHIUM2_AARCH64_asm_intt_SIMD_bot, %function
+#endif
+PQCLEAN_DILITHIUM2_AARCH64_asm_intt_SIMD_bot:
+_PQCLEAN_DILITHIUM2_AARCH64_asm_intt_SIMD_bot:
+
+    push_all
+    Q         .req w20
+    RphRdp    .req x21
+    src0      .req x0
+    des0      .req x1
+    src1      .req x2
+    des1      .req x3
+    table0    .req x28
+    table1    .req x27
+    counter   .req x19
+
+    ldr Q, [x2]
+    ldr RphRdp, [x2, #8]
+
+    add table0, x1, #128
+    add table1, table0, #1024
+
+    add src1, src0, #512    
+
+    add des0, src0, #0
+    add des1, src0, #512
+
+    mov counter, #8
+    _intt_bot_loop:
+
+    ld4 {  v0.4S,  v1.4S,  v2.4S,  v3.4S}, [src0], #64
+    ld4 { v16.4S, v17.4S, v18.4S, v19.4S}, [src1], #64
+
+    ld1 {  v4.4S,  v5.4S}, [table0], #32
+    ld2 {  v6.4S,  v7.4S}, [table0], #32
+    ld4 {  v8.4S,  v9.4S, v10.4S, v11.4S}, [table0], #64
+    ld1 { v20.4S, v21.4S}, [table1], #32
+    ld2 { v22.4S, v23.4S}, [table1], #32
+    ld4 { v24.4S, v25.4S, v26.4S, v27.4S}, [table1], #64
+
+    mov v4.S[0], Q
+    mov v20.D[0], RphRdp
+
+    dq_butterfly_vec_bot  v0,  v2, v12, v13,  v1,  v3,  v4,  v8,  v9, v10, v11
+    dq_butterfly_vec_mixed_rev  v0,  v2, v12, v13,  v1,  v3, v16, v18, v28, v29, v17, v19,  v4,  v8,  v9, v10, v11, v24, v25, v26, v27
+    dq_butterfly_vec_mixed_rev v16, v18, v28, v29, v17, v19,  v0,  v1, v12, v13,  v2,  v3,  v4, v24, v25, v26, v27,  v6,  v7,  v6,  v7
+    dq_butterfly_vec_mixed_rev  v0,  v1, v12, v13,  v2,  v3, v16, v17, v28, v29, v18, v19,  v4,  v6,  v7,  v6,  v7, v22, v23, v22, v23
+    dq_butterfly_vec_top v16, v17, v28, v29, v18, v19,  v4, v22, v23, v22, v23
+
+    trn_4x4  v0,  v1,  v2,  v3, v12, v13, v14, v15
+    trn_4x4 v16, v17, v18, v19, v28, v29, v30, v31
+
+    dq_butterfly_bot  v0,  v2, v12, v13,  v1,  v3,  v4,  v5, 0, 1,  v5, 2, 3
+    dq_butterfly_mixed_rev  v0,  v2, v12, v13,  v1,  v3, v16, v18, v28, v29, v17, v19,  v4,  v5, 0, 1,  v5, 2, 3, v21, 0, 1, v21, 2, 3
+    dq_butterfly_mixed_rev v16, v18, v28, v29, v17, v19,  v0,  v1, v12, v13,  v2,  v3,  v4, v21, 0, 1, v21, 2, 3,  v4, 2, 3,  v4, 2, 3
+    dq_butterfly_mixed_rev  v0,  v1, v12, v13,  v2,  v3, v16, v17, v28, v29, v18, v19,  v4,  v4, 2, 3,  v4, 2, 3, v20, 2, 3, v20, 2, 3
+    dq_butterfly_top v16, v17, v28, v29, v18, v19,  v4, v20, 2, 3, v20, 2, 3
+
+    srshr v14.4S,  v0.4S, #23
+    srshr v15.4S,  v1.4S, #23
+    srshr v30.4S, v16.4S, #23
+    srshr v31.4S, v17.4S, #23
+
+    mls    v0.4S, v14.4S, v4.S[0]
+    mls    v1.4S, v15.4S, v4.S[0]
+    mls   v16.4S, v30.4S, v4.S[0]
+    mls   v17.4S, v31.4S, v4.S[0]
+
+    st1 {  v0.4S,  v1.4S,  v2.4S,  v3.4S}, [des0], #64
+    st1 { v16.4S, v17.4S, v18.4S, v19.4S}, [des1], #64
+
+    sub counter, counter, #1
+    cbnz counter, _intt_bot_loop
+
+    .unreq    Q
+    .unreq    RphRdp
+    .unreq    src0
+    .unreq    des0
+    .unreq    src1
+    .unreq    des1
+    .unreq    table0
+    .unreq    table1
+    .unreq    counter
+    pop_all
+
+    br lr
+
+
+
+
+
+

src/sign/dilithium/dilithium2/aarch64/api.h

@@ -0,0 +1,32 @@
+#ifndef PQCLEAN_DILITHIUM2_AARCH64_API_H
+#define PQCLEAN_DILITHIUM2_AARCH64_API_H
+
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define PQCLEAN_DILITHIUM2_AARCH64_CRYPTO_PUBLICKEYBYTES 1312
+#define PQCLEAN_DILITHIUM2_AARCH64_CRYPTO_SECRETKEYBYTES 2528
+#define PQCLEAN_DILITHIUM2_AARCH64_CRYPTO_BYTES 2420
+#define PQCLEAN_DILITHIUM2_AARCH64_CRYPTO_ALGNAME "Dilithium2"
+
+int PQCLEAN_DILITHIUM2_AARCH64_crypto_sign_keypair(uint8_t *pk, uint8_t *sk);
+
+int PQCLEAN_DILITHIUM2_AARCH64_crypto_sign_signature(
+    uint8_t *sig, size_t *siglen,
+    const uint8_t *m, size_t mlen, const uint8_t *sk);
+
+int PQCLEAN_DILITHIUM2_AARCH64_crypto_sign_verify(
+    const uint8_t *sig, size_t siglen,
+    const uint8_t *m, size_t mlen, const uint8_t *pk);
+
+int PQCLEAN_DILITHIUM2_AARCH64_crypto_sign(
+    uint8_t *sm, size_t *smlen,
+    const uint8_t *m, size_t mlen, const uint8_t *sk);
+
+int PQCLEAN_DILITHIUM2_AARCH64_crypto_sign_open(
+    uint8_t *m, size_t *mlen,
+    const uint8_t *sm, size_t smlen, const uint8_t *pk);
+
+
+#endif

src/sign/dilithium/dilithium2/aarch64/fips202x2.c

@@ -0,0 +1,646 @@
+#include "fips202x2.h"
+#include <arm_neon.h>
+#include <stddef.h>
+
+
+#define NROUNDS 24
+
+// Define NEON operation
+// c = load(ptr)
+#define vload(ptr) vld1q_u64(ptr);
+// ptr <= c;
+#define vstore(ptr, c) vst1q_u64(ptr, c);
+// c = a ^ b
+#define vxor(c, a, b) c = veorq_u64(a, b);
+// Rotate by n bit ((a << offset) ^ (a >> (64-offset)))
+#define vROL(out, a, offset)    \
+    (out) = vshlq_n_u64(a, offset); \
+    (out) = vsriq_n_u64(out, a, 64 - (offset));
+// Xor chain: out = a ^ b ^ c ^ d ^ e
+#define vXOR4(out, a, b, c, d, e) \
+    (out) = veorq_u64(a, b);          \
+    (out) = veorq_u64(out, c);        \
+    (out) = veorq_u64(out, d);        \
+    (out) = veorq_u64(out, e);
+// Not And c = ~a & b
+// #define vbic(c, a, b) c = vbicq_u64(b, a);
+// Xor Not And: out = a ^ ( (~b) & c)
+#define vXNA(out, a, b, c) \
+    (out) = vbicq_u64(c, b);   \
+    (out) = veorq_u64(out, a);
+// Rotate by 1 bit, then XOR: a ^ ROL(b): SHA1 instruction, not support
+#define vrxor(c, a, b) c = vrax1q_u64(a, b);
+// End Define
+
+/* Keccak round constants */
+static const uint64_t neon_KeccakF_RoundConstants[NROUNDS] = {
+    (uint64_t)0x0000000000000001ULL,
+    (uint64_t)0x0000000000008082ULL,
+    (uint64_t)0x800000000000808aULL,
+    (uint64_t)0x8000000080008000ULL,
+    (uint64_t)0x000000000000808bULL,
+    (uint64_t)0x0000000080000001ULL,
+    (uint64_t)0x8000000080008081ULL,
+    (uint64_t)0x8000000000008009ULL,
+    (uint64_t)0x000000000000008aULL,
+    (uint64_t)0x0000000000000088ULL,
+    (uint64_t)0x0000000080008009ULL,
+    (uint64_t)0x000000008000000aULL,
+    (uint64_t)0x000000008000808bULL,
+    (uint64_t)0x800000000000008bULL,
+    (uint64_t)0x8000000000008089ULL,
+    (uint64_t)0x8000000000008003ULL,
+    (uint64_t)0x8000000000008002ULL,
+    (uint64_t)0x8000000000000080ULL,
+    (uint64_t)0x000000000000800aULL,
+    (uint64_t)0x800000008000000aULL,
+    (uint64_t)0x8000000080008081ULL,
+    (uint64_t)0x8000000000008080ULL,
+    (uint64_t)0x0000000080000001ULL,
+    (uint64_t)0x8000000080008008ULL
+};
+
+/*************************************************
+* Name:        KeccakF1600_StatePermutex2
+*
+* Description: The Keccak F1600 Permutation
+*
+* Arguments:   - uint64_t *state: pointer to input/output Keccak state
+**************************************************/
+static inline
+void KeccakF1600_StatePermutex2(v128 state[25]) {
+    v128 Aba, Abe, Abi, Abo, Abu;
+    v128 Aga, Age, Agi, Ago, Agu;
+    v128 Aka, Ake, Aki, Ako, Aku;
+    v128 Ama, Ame, Ami, Amo, Amu;
+    v128 Asa, Ase, Asi, Aso, Asu;
+    v128 BCa, BCe, BCi, BCo, BCu; // tmp
+    v128 Da, De, Di, Do, Du;      // D
+    v128 Eba, Ebe, Ebi, Ebo, Ebu;
+    v128 Ega, Ege, Egi, Ego, Egu;
+    v128 Eka, Eke, Eki, Eko, Eku;
+    v128 Ema, Eme, Emi, Emo, Emu;
+    v128 Esa, Ese, Esi, Eso, Esu;
+
+    //copyFromState(A, state)
+    Aba = state[0];
+    Abe = state[1];
+    Abi = state[2];
+    Abo = state[3];
+    Abu = state[4];
+    Aga = state[5];
+    Age = state[6];
+    Agi = state[7];
+    Ago = state[8];
+    Agu = state[9];
+    Aka = state[10];
+    Ake = state[11];
+    Aki = state[12];
+    Ako = state[13];
+    Aku = state[14];
+    Ama = state[15];
+    Ame = state[16];
+    Ami = state[17];
+    Amo = state[18];
+    Amu = state[19];
+    Asa = state[20];
+    Ase = state[21];
+    Asi = state[22];
+    Aso = state[23];
+    Asu = state[24];
+
+    for (int round = 0; round < NROUNDS; round += 2) {
+        //    prepareTheta
+        vXOR4(BCa, Aba, Aga, Aka, Ama, Asa);
+        vXOR4(BCe, Abe, Age, Ake, Ame, Ase);
+        vXOR4(BCi, Abi, Agi, Aki, Ami, Asi);
+        vXOR4(BCo, Abo, Ago, Ako, Amo, Aso);
+        vXOR4(BCu, Abu, Agu, Aku, Amu, Asu);
+
+        //thetaRhoPiChiIotaPrepareTheta(round  , A, E)
+        vROL(Da, BCe, 1);
+        vxor(Da, BCu, Da);
+        vROL(De, BCi, 1);
+        vxor(De, BCa, De);
+        vROL(Di, BCo, 1);
+        vxor(Di, BCe, Di);
+        vROL(Do, BCu, 1);
+        vxor(Do, BCi, Do);
+        vROL(Du, BCa, 1);
+        vxor(Du, BCo, Du);
+
+        vxor(Aba, Aba, Da);
+        vxor(Age, Age, De);
+        vROL(BCe, Age, 44);
+        vxor(Aki, Aki, Di);
+        vROL(BCi, Aki, 43);
+        vxor(Amo, Amo, Do);
+        vROL(BCo, Amo, 21);
+        vxor(Asu, Asu, Du);
+        vROL(BCu, Asu, 14);
+        vXNA(Eba, Aba, BCe, BCi);
+        vxor(Eba, Eba, vdupq_n_u64(neon_KeccakF_RoundConstants[round]));
+        vXNA(Ebe, BCe, BCi, BCo);
+        vXNA(Ebi, BCi, BCo, BCu);
+        vXNA(Ebo, BCo, BCu, Aba);
+        vXNA(Ebu, BCu, Aba, BCe);
+
+        vxor(Abo, Abo, Do);
+        vROL(BCa, Abo, 28);
+        vxor(Agu, Agu, Du);
+        vROL(BCe, Agu, 20);
+        vxor(Aka, Aka, Da);
+        vROL(BCi, Aka, 3);
+        vxor(Ame, Ame, De);
+        vROL(BCo, Ame, 45);
+        vxor(Asi, Asi, Di);
+        vROL(BCu, Asi, 61);
+        vXNA(Ega, BCa, BCe, BCi);
+        vXNA(Ege, BCe, BCi, BCo);
+        vXNA(Egi, BCi, BCo, BCu);
+        vXNA(Ego, BCo, BCu, BCa);
+        vXNA(Egu, BCu, BCa, BCe);
+
+        vxor(Abe, Abe, De);
+        vROL(BCa, Abe, 1);
+        vxor(Agi, Agi, Di);
+        vROL(BCe, Agi, 6);
+        vxor(Ako, Ako, Do);
+        vROL(BCi, Ako, 25);
+        vxor(Amu, Amu, Du);
+        vROL(BCo, Amu, 8);
+        vxor(Asa, Asa, Da);
+        vROL(BCu, Asa, 18);
+        vXNA(Eka, BCa, BCe, BCi);
+        vXNA(Eke, BCe, BCi, BCo);
+        vXNA(Eki, BCi, BCo, BCu);
+        vXNA(Eko, BCo, BCu, BCa);
+        vXNA(Eku, BCu, BCa, BCe);
+
+        vxor(Abu, Abu, Du);
+        vROL(BCa, Abu, 27);
+        vxor(Aga, Aga, Da);
+        vROL(BCe, Aga, 36);
+        vxor(Ake, Ake, De);
+        vROL(BCi, Ake, 10);
+        vxor(Ami, Ami, Di);
+        vROL(BCo, Ami, 15);
+        vxor(Aso, Aso, Do);
+        vROL(BCu, Aso, 56);
+        vXNA(Ema, BCa, BCe, BCi);
+        vXNA(Eme, BCe, BCi, BCo);
+        vXNA(Emi, BCi, BCo, BCu);
+        vXNA(Emo, BCo, BCu, BCa);
+        vXNA(Emu, BCu, BCa, BCe);
+
+        vxor(Abi, Abi, Di);
+        vROL(BCa, Abi, 62);
+        vxor(Ago, Ago, Do);
+        vROL(BCe, Ago, 55);
+        vxor(Aku, Aku, Du);
+        vROL(BCi, Aku, 39);
+        vxor(Ama, Ama, Da);
+        vROL(BCo, Ama, 41);
+        vxor(Ase, Ase, De);
+        vROL(BCu, Ase, 2);
+        vXNA(Esa, BCa, BCe, BCi);
+        vXNA(Ese, BCe, BCi, BCo);
+        vXNA(Esi, BCi, BCo, BCu);
+        vXNA(Eso, BCo, BCu, BCa);
+        vXNA(Esu, BCu, BCa, BCe);
+
+        // Next Round
+
+        //    prepareTheta
+        vXOR4(BCa, Eba, Ega, Eka, Ema, Esa);
+        vXOR4(BCe, Ebe, Ege, Eke, Eme, Ese);
+        vXOR4(BCi, Ebi, Egi, Eki, Emi, Esi);
+        vXOR4(BCo, Ebo, Ego, Eko, Emo, Eso);
+        vXOR4(BCu, Ebu, Egu, Eku, Emu, Esu);
+
+        //thetaRhoPiChiIotaPrepareTheta(round+1, E, A)
+        vROL(Da, BCe, 1);
+        vxor(Da, BCu, Da);
+        vROL(De, BCi, 1);
+        vxor(De, BCa, De);
+        vROL(Di, BCo, 1);
+        vxor(Di, BCe, Di);
+        vROL(Do, BCu, 1);
+        vxor(Do, BCi, Do);
+        vROL(Du, BCa, 1);
+        vxor(Du, BCo, Du);
+
+        vxor(Eba, Eba, Da);
+        vxor(Ege, Ege, De);
+        vROL(BCe, Ege, 44);
+        vxor(Eki, Eki, Di);
+        vROL(BCi, Eki, 43);
+        vxor(Emo, Emo, Do);
+        vROL(BCo, Emo, 21);
+        vxor(Esu, Esu, Du);
+        vROL(BCu, Esu, 14);
+        vXNA(Aba, Eba, BCe, BCi);
+        vxor(Aba, Aba, vdupq_n_u64(neon_KeccakF_RoundConstants[round + 1]));
+        vXNA(Abe, BCe, BCi, BCo);
+        vXNA(Abi, BCi, BCo, BCu);
+        vXNA(Abo, BCo, BCu, Eba);
+        vXNA(Abu, BCu, Eba, BCe);
+
+        vxor(Ebo, Ebo, Do);
+        vROL(BCa, Ebo, 28);
+        vxor(Egu, Egu, Du);
+        vROL(BCe, Egu, 20);
+        vxor(Eka, Eka, Da);
+        vROL(BCi, Eka, 3);
+        vxor(Eme, Eme, De);
+        vROL(BCo, Eme, 45);
+        vxor(Esi, Esi, Di);
+        vROL(BCu, Esi, 61);
+        vXNA(Aga, BCa, BCe, BCi);
+        vXNA(Age, BCe, BCi, BCo);
+        vXNA(Agi, BCi, BCo, BCu);
+        vXNA(Ago, BCo, BCu, BCa);
+        vXNA(Agu, BCu, BCa, BCe);
+
+        vxor(Ebe, Ebe, De);
+        vROL(BCa, Ebe, 1);
+        vxor(Egi, Egi, Di);
+        vROL(BCe, Egi, 6);
+        vxor(Eko, Eko, Do);
+        vROL(BCi, Eko, 25);
+        vxor(Emu, Emu, Du);
+        vROL(BCo, Emu, 8);
+        vxor(Esa, Esa, Da);
+        vROL(BCu, Esa, 18);
+        vXNA(Aka, BCa, BCe, BCi);
+        vXNA(Ake, BCe, BCi, BCo);
+        vXNA(Aki, BCi, BCo, BCu);
+        vXNA(Ako, BCo, BCu, BCa);
+        vXNA(Aku, BCu, BCa, BCe);
+
+        vxor(Ebu, Ebu, Du);
+        vROL(BCa, Ebu, 27);
+        vxor(Ega, Ega, Da);
+        vROL(BCe, Ega, 36);
+        vxor(Eke, Eke, De);
+        vROL(BCi, Eke, 10);
+        vxor(Emi, Emi, Di);
+        vROL(BCo, Emi, 15);
+        vxor(Eso, Eso, Do);
+        vROL(BCu, Eso, 56);
+        vXNA(Ama, BCa, BCe, BCi);
+        vXNA(Ame, BCe, BCi, BCo);
+        vXNA(Ami, BCi, BCo, BCu);
+        vXNA(Amo, BCo, BCu, BCa);
+        vXNA(Amu, BCu, BCa, BCe);
+
+        vxor(Ebi, Ebi, Di);
+        vROL(BCa, Ebi, 62);
+        vxor(Ego, Ego, Do);
+        vROL(BCe, Ego, 55);
+        vxor(Eku, Eku, Du);
+        vROL(BCi, Eku, 39);
+        vxor(Ema, Ema, Da);
+        vROL(BCo, Ema, 41);
+        vxor(Ese, Ese, De);
+        vROL(BCu, Ese, 2);
+        vXNA(Asa, BCa, BCe, BCi);
+        vXNA(Ase, BCe, BCi, BCo);
+        vXNA(Asi, BCi, BCo, BCu);
+        vXNA(Aso, BCo, BCu, BCa);
+        vXNA(Asu, BCu, BCa, BCe);
+    }
+
+    state[0] = Aba;
+    state[1] = Abe;
+    state[2] = Abi;
+    state[3] = Abo;
+    state[4] = Abu;
+    state[5] = Aga;
+    state[6] = Age;
+    state[7] = Agi;
+    state[8] = Ago;
+    state[9] = Agu;
+    state[10] = Aka;
+    state[11] = Ake;
+    state[12] = Aki;
+    state[13] = Ako;
+    state[14] = Aku;
+    state[15] = Ama;
+    state[16] = Ame;
+    state[17] = Ami;
+    state[18] = Amo;
+    state[19] = Amu;
+    state[20] = Asa;
+    state[21] = Ase;
+    state[22] = Asi;
+    state[23] = Aso;
+    state[24] = Asu;
+}
+
+/*************************************************
+* Name:        keccakx2_absorb
+*
+* Description: Absorb step of Keccak;
+*              non-incremental, starts by zeroeing the state.
+*
+* Arguments:   - uint64_t *s: pointer to (uninitialized) output Keccak state
+*              - unsigned int r: rate in bytes (e.g., 168 for SHAKE128)
+*              - const uint8_t *m: pointer to input to be absorbed into s
+*              - size_t mlen: length of input in bytes
+*              - uint8_t p: domain-separation byte for different
+*                           Keccak-derived functions
+**************************************************/
+static
+void keccakx2_absorb(v128 s[25],
+                     unsigned int r,
+                     const uint8_t *in0,
+                     const uint8_t *in1,
+                     size_t inlen,
+                     uint8_t p) {
+    size_t i, pos = 0;
+
+    // Declare SIMD registers
+    v128 tmp, mask;
+    uint64x1_t a, b;
+    uint64x2_t a1, b1, atmp1, btmp1;
+    uint64x2x2_t a2, b2, atmp2, btmp2;
+    // End
+
+    for (i = 0; i < 25; ++i) {
+        s[i] = vdupq_n_u64(0);
+    }
+
+    // Load in0[i] to register, then in1[i] to register, exchange them
+    while (inlen >= r) {
+        for (i = 0; i < r / 8 - 1; i += 4) {
+            a2 = vld1q_u64_x2((uint64_t *)&in0[pos]);
+            b2 = vld1q_u64_x2((uint64_t *)&in1[pos]);
+            // BD = zip1(AB and CD)
+            atmp2.val[0] = vzip1q_u64(a2.val[0], b2.val[0]);
+            atmp2.val[1] = vzip1q_u64(a2.val[1], b2.val[1]);
+            // AC = zip2(AB and CD)
+            btmp2.val[0] = vzip2q_u64(a2.val[0], b2.val[0]);
+            btmp2.val[1] = vzip2q_u64(a2.val[1], b2.val[1]);
+
+            vxor(s[i + 0], s[i + 0], atmp2.val[0]);
+            vxor(s[i + 1], s[i + 1], btmp2.val[0]);
+            vxor(s[i + 2], s[i + 2], atmp2.val[1]);
+            vxor(s[i + 3], s[i + 3], btmp2.val[1]);
+
+            pos += 8 * 2 * 2;
+        }
+        // Last iteration
+        i = r / 8 - 1;
+        a = vld1_u64((uint64_t *)&in0[pos]);
+        b = vld1_u64((uint64_t *)&in1[pos]);
+        tmp = vcombine_u64(a, b);
+        vxor(s[i], s[i], tmp);
+        pos += 8;
+
+        KeccakF1600_StatePermutex2(s);
+        inlen -= r;
+    }
+
+    i = 0;
+    while (inlen >= 16) {
+        a1 = vld1q_u64((uint64_t *)&in0[pos]);
+        b1 = vld1q_u64((uint64_t *)&in1[pos]);
+        // BD = zip1(AB and CD)
+        atmp1 = vzip1q_u64(a1, b1);
+        // AC = zip2(AB and CD)
+        btmp1 = vzip2q_u64(a1, b1);
+
+        vxor(s[i + 0], s[i + 0], atmp1);
+        vxor(s[i + 1], s[i + 1], btmp1);
+
+        i += 2;
+        pos += 8 * 2;
+        inlen -= 8 * 2;
+    }
+
+    if (inlen >= 8) {
+        a = vld1_u64((uint64_t *)&in0[pos]);
+        b = vld1_u64((uint64_t *)&in1[pos]);
+        tmp = vcombine_u64(a, b);
+        vxor(s[i], s[i], tmp);
+
+        i++;
+        pos += 8;
+        inlen -= 8;
+    }
+
+    if (inlen) {
+        a = vld1_u64((uint64_t *)&in0[pos]);
+        b = vld1_u64((uint64_t *)&in1[pos]);
+        tmp = vcombine_u64(a, b);
+        mask = vdupq_n_u64((1ULL << (8 * inlen)) - 1);
+        tmp = vandq_u64(tmp, mask);
+        vxor(s[i], s[i], tmp);
+    }
+
+    tmp = vdupq_n_u64((uint64_t)p << (8 * inlen));
+    vxor(s[i], s[i], tmp);
+
+    mask = vdupq_n_u64(1ULL << 63);
+    vxor(s[r / 8 - 1], s[r / 8 - 1], mask);
+}
+
+/*************************************************
+* Name:        keccak_squeezeblocks
+*
+* Description: Squeeze step of Keccak. Squeezes full blocks of r bytes each.
+*              Modifies the state. Can be called multiple times to keep
+*              squeezing, i.e., is incremental.
+*
+* Arguments:   - uint8_t *out: pointer to output blocks
+*              - size_t nblocks: number of blocks to be squeezed (written to h)
+*              - unsigned int r: rate in bytes (e.g., 168 for SHAKE128)
+*              - uint64_t *s: pointer to input/output Keccak state
+**************************************************/
+static
+void keccakx2_squeezeblocks(uint8_t *out0,
+                            uint8_t *out1,
+                            size_t nblocks,
+                            unsigned int r,
+                            v128 s[25]) {
+    unsigned int i;
+
+    uint64x1_t a, b;
+    uint64x2x2_t a2, b2;
+
+    while (nblocks > 0) {
+        KeccakF1600_StatePermutex2(s);
+
+        for (i = 0; i < r / 8 - 1; i += 4) {
+            a2.val[0] = vuzp1q_u64(s[i], s[i + 1]);
+            b2.val[0] = vuzp2q_u64(s[i], s[i + 1]);
+            a2.val[1] = vuzp1q_u64(s[i + 2], s[i + 3]);
+            b2.val[1] = vuzp2q_u64(s[i + 2], s[i + 3]);
+            vst1q_u64_x2((uint64_t *)out0, a2);
+            vst1q_u64_x2((uint64_t *)out1, b2);
+
+            out0 += 32;
+            out1 += 32;
+        }
+
+        i = r / 8 - 1;
+        // Last iteration
+        a = vget_low_u64(s[i]);
+        b = vget_high_u64(s[i]);
+        vst1_u64((uint64_t *)out0, a);
+        vst1_u64((uint64_t *)out1, b);
+
+        out0 += 8;
+        out1 += 8;
+
+        --nblocks;
+    }
+}
+
+/*************************************************
+* Name:        shake128x2_absorb
+*
+* Description: Absorb step of the SHAKE128 XOF.
+*              non-incremental, starts by zeroeing the state.
+*
+* Arguments:   - keccakx2_state *state: pointer to (uninitialized) output
+*                                     Keccak state
+*              - const uint8_t *in:   pointer to input to be absorbed into s
+*              - size_t inlen:        length of input in bytes
+**************************************************/
+void shake128x2_absorb(keccakx2_state *state,
+                       const uint8_t *in0,
+                       const uint8_t *in1,
+                       size_t inlen) {
+    keccakx2_absorb(state->s, SHAKE128_RATE, in0, in1, inlen, 0x1F);
+}
+
+/*************************************************
+* Name:        shake128_squeezeblocks
+*
+* Description: Squeeze step of SHAKE128 XOF. Squeezes full blocks of
+*              SHAKE128_RATE bytes each. Modifies the state. Can be called
+*              multiple times to keep squeezing, i.e., is incremental.
+*
+* Arguments:   - uint8_t *out:    pointer to output blocks
+*              - size_t nblocks:  number of blocks to be squeezed
+*                                 (written to output)
+*              - keccakx2_state *s: pointer to input/output Keccak state
+**************************************************/
+void shake128x2_squeezeblocks(uint8_t *out0,
+                              uint8_t *out1,
+                              size_t nblocks,
+                              keccakx2_state *state) {
+    keccakx2_squeezeblocks(out0, out1, nblocks, SHAKE128_RATE, state->s);
+}
+
+/*************************************************
+* Name:        shake256_absorb
+*
+* Description: Absorb step of the SHAKE256 XOF.
+*              non-incremental, starts by zeroeing the state.
+*
+* Arguments:   - keccakx2_state *s:   pointer to (uninitialized) output Keccak state
+*              - const uint8_t *in: pointer to input to be absorbed into s
+*              - size_t inlen:      length of input in bytes
+**************************************************/
+void shake256x2_absorb(keccakx2_state *state,
+                       const uint8_t *in0,
+                       const uint8_t *in1,
+                       size_t inlen) {
+    keccakx2_absorb(state->s, SHAKE256_RATE, in0, in1, inlen, 0x1F);
+}
+
+/*************************************************
+* Name:        shake256_squeezeblocks
+*
+* Description: Squeeze step of SHAKE256 XOF. Squeezes full blocks of
+*              SHAKE256_RATE bytes each. Modifies the state. Can be called
+*              multiple times to keep squeezing, i.e., is incremental.
+*
+* Arguments:   - uint8_t *out:    pointer to output blocks
+*              - size_t nblocks:  number of blocks to be squeezed
+*                                 (written to output)
+*              - keccakx2_state *s: pointer to input/output Keccak state
+**************************************************/
+void shake256x2_squeezeblocks(uint8_t *out0,
+                              uint8_t *out1,
+                              size_t nblocks,
+                              keccakx2_state *state) {
+    keccakx2_squeezeblocks(out0, out1, nblocks, SHAKE256_RATE, state->s);
+}
+
+/*************************************************
+* Name:        shake128
+*
+* Description: SHAKE128 XOF with non-incremental API
+*
+* Arguments:   - uint8_t *out:      pointer to output
+*              - size_t outlen:     requested output length in bytes
+*              - const uint8_t *in: pointer to input
+*              - size_t inlen:      length of input in bytes
+**************************************************/
+void shake128x2(uint8_t *out0,
+                uint8_t *out1,
+                size_t outlen,
+                const uint8_t *in0,
+                const uint8_t *in1,
+                size_t inlen) {
+    unsigned int i;
+    size_t nblocks = outlen / SHAKE128_RATE;
+    uint8_t t[2][SHAKE128_RATE];
+    keccakx2_state state;
+
+    shake128x2_absorb(&state, in0, in1, inlen);
+    shake128x2_squeezeblocks(out0, out1, nblocks, &state);
+
+    out0 += nblocks * SHAKE128_RATE;
+    out1 += nblocks * SHAKE128_RATE;
+    outlen -= nblocks * SHAKE128_RATE;
+
+    if (outlen) {
+        shake128x2_squeezeblocks(t[0], t[1], 1, &state);
+        for (i = 0; i < outlen; ++i) {
+            out0[i] = t[0][i];
+            out1[i] = t[1][i];
+        }
+    }
+}
+
+/*************************************************
+* Name:        shake256
+*
+* Description: SHAKE256 XOF with non-incremental API
+*
+* Arguments:   - uint8_t *out:      pointer to output
+*              - size_t outlen:     requested output length in bytes
+*              - const uint8_t *in: pointer to input
+*              - size_t inlen:      length of input in bytes
+**************************************************/
+void shake256x2(uint8_t *out0,
+                uint8_t *out1,
+                size_t outlen,
+                const uint8_t *in0,
+                const uint8_t *in1,
+                size_t inlen) {
+    unsigned int i;
+    size_t nblocks = outlen / SHAKE256_RATE;
+    uint8_t t[2][SHAKE256_RATE];
+    keccakx2_state state;
+
+    shake256x2_absorb(&state, in0, in1, inlen);
+    shake256x2_squeezeblocks(out0, out1, nblocks, &state);
+
+    out0 += nblocks * SHAKE256_RATE;
+    out1 += nblocks * SHAKE256_RATE;
+    outlen -= nblocks * SHAKE256_RATE;
+
+    if (outlen) {
+        shake256x2_squeezeblocks(t[0], t[1], 1, &state);
+        for (i = 0; i < outlen; ++i) {
+            out0[i] = t[0][i];
+            out1[i] = t[1][i];
+        }
+    }
+}

src/sign/dilithium/dilithium2/aarch64/fips202x2.h

@@ -0,0 +1,60 @@
+#ifndef FIPS202X2_H
+#define FIPS202X2_H
+
+#include "params.h"
+#include <arm_neon.h>
+#include <stddef.h>
+
+typedef uint64x2_t v128;
+
+#define SHAKE128_RATE 168
+#define SHAKE256_RATE 136
+#define SHA3_256_RATE 136
+#define SHA3_512_RATE 72
+
+
+typedef struct {
+    v128 s[25];
+} keccakx2_state;
+
+
+#define shake128x2_absorb DILITHIUM_NAMESPACE(shake128x2_absorb)
+void shake128x2_absorb(keccakx2_state *state,
+                       const uint8_t *in0,
+                       const uint8_t *in1,
+                       size_t inlen);
+
+#define shake128x2_squeezeblocks DILITHIUM_NAMESPACE(shake128x2_squeezeblocks)
+void shake128x2_squeezeblocks(uint8_t *out0,
+                              uint8_t *out1,
+                              size_t nblocks,
+                              keccakx2_state *state);
+
+#define shake256x2_absorb DILITHIUM_NAMESPACE(shake256x2_absorb)
+void shake256x2_absorb(keccakx2_state *state,
+                       const uint8_t *in0,
+                       const uint8_t *in1,
+                       size_t inlen);
+
+#define shake256x2_squeezeblocks DILITHIUM_NAMESPACE(shake256x2_squeezeblocks)
+void shake256x2_squeezeblocks(uint8_t *out0,
+                              uint8_t *out1,
+                              size_t nblocks,
+                              keccakx2_state *state);
+
+#define shake128x2 DILITHIUM_NAMESPACE(shake128x2)
+void shake128x2(uint8_t *out0,
+                uint8_t *out1,
+                size_t outlen,
+                const uint8_t *in0,
+                const uint8_t *in1,
+                size_t inlen);
+
+#define shake256x2 DILITHIUM_NAMESPACE(shake256x2)
+void shake256x2(uint8_t *out0,
+                uint8_t *out1,
+                size_t outlen,
+                const uint8_t *in0,
+                const uint8_t *in1,
+                size_t inlen);
+#endif

src/sign/dilithium/dilithium2/aarch64/macros.inc

@@ -0,0 +1,84 @@
+#include "macros_common.inc"
+
+.macro wrap_trn_4x4 a0, a1, a2, a3, t0, t1, t2, t3, qS, dD
+
+    trn1 \t0\qS, \a0\qS, \a1\qS
+    trn2 \t1\qS, \a0\qS, \a1\qS
+    trn1 \t2\qS, \a2\qS, \a3\qS
+    trn2 \t3\qS, \a2\qS, \a3\qS
+
+    trn1 \a0\dD, \t0\dD, \t2\dD
+    trn2 \a2\dD, \t0\dD, \t2\dD
+    trn1 \a1\dD, \t1\dD, \t3\dD
+    trn2 \a3\dD, \t1\dD, \t3\dD
+
+.endm
+
+.macro trn_4x4 a0, a1, a2, a3, t0, t1, t2, t3
+    wrap_trn_4x4 \a0, \a1, \a2, \a3, \t0, \t1, \t2, \t3, .4S, .2D
+.endm
+
+
+.macro dq_butterfly_vec_bot a0, a1, b0, b1, t0, t1, mod, l0, h0, l1, h1
+    wrap_dX_butterfly_vec_bot \a0, \a1, \b0, \b1, \t0, \t1, \mod, \l0, \h0, \l1, \h1, .4S, .S
+.endm
+
+.macro dq_butterfly_vec_top a0, a1, b0, b1, t0, t1, mod, l0, h0, l1, h1
+    wrap_dX_butterfly_vec_top \a0, \a1, \b0, \b1, \t0, \t1, \mod, \l0, \h0, \l1, \h1, .4S, .S
+.endm
+
+.macro dq_butterfly_vec_mixed a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, l0, h0, l1, h1, l2, h2, l3, h3
+    wrap_dX_butterfly_vec_mixed \a0, \a1, \b0, \b1, \t0, \t1, \a2, \a3, \b2, \b3, \t2, \t3, \mod, \l0, \h0, \l1, \h1, \l2, \h2, \l3, \h3, .4S, .S
+.endm
+
+.macro dq_butterfly_vec_mixed_rev a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, l0, h0, l1, h1, l2, h2, l3, h3
+    wrap_dX_butterfly_vec_mixed_rev \a0, \a1, \b0, \b1, \t0, \t1, \a2, \a3, \b2, \b3, \t2, \t3, \mod, \l0, \h0, \l1, \h1, \l2, \h2, \l3, \h3, .4S, .S
+.endm
+
+
+.macro dq_butterfly_top a0, a1, b0, b1, t0, t1, mod, z0, l0, h0, z1, l1, h1
+    wrap_dX_butterfly_top \a0, \a1, \b0, \b1, \t0, \t1, \mod, \z0, \l0, \h0, \z1, \l1, \h1, .4S, .S
+.endm
+
+.macro dq_butterfly_bot a0, a1, b0, b1, t0, t1, mod, z0, l0, h0, z1, l1, h1
+    wrap_dX_butterfly_bot \a0, \a1, \b0, \b1, \t0, \t1, \mod, \z0, \l0, \h0, \z1, \l1, \h1, .4S, .S
+.endm
+
+.macro dq_butterfly_mixed a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3
+    wrap_dX_butterfly_mixed \a0, \a1, \b0, \b1, \t0, \t1, \a2, \a3, \b2, \b3, \t2, \t3, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, .4S, .S
+.endm
+
+.macro dq_butterfly_mixed_rev a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3
+    wrap_dX_butterfly_mixed_rev \a0, \a1, \b0, \b1, \t0, \t1, \a2, \a3, \b2, \b3, \t2, \t3, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, .4S, .S
+.endm
+
+
+.macro qq_montgomery_mul b0, b1, b2, b3, t0, t1, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3
+    wrap_qX_montgomery_mul \b0, \b1, \b2, \b3, \t0, \t1, \t2, \t3, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, .4S, .S
+.endm
+
+
+.macro qq_butterfly_top a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3
+    wrap_qX_butterfly_top \a0, \a1, \a2, \a3, \b0, \b1, \b2, \b3, \t0, \t1, \t2, \t3, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, .4S, .S
+.endm
+
+.macro qq_butterfly_bot a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3
+    wrap_qX_butterfly_bot \a0, \a1, \a2, \a3, \b0, \b1, \b2, \b3, \t0, \t1, \t2, \t3, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, .4S, .S
+.endm
+
+.macro qq_butterfly_mixed a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, a4, a5, a6, a7, b4, b5, b6, b7, t4, t5, t6, t7, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, z4, l4, h4, z5, l5, h5, z6, l6, h6, z7, l7, h7
+    wrap_qX_butterfly_mixed \a0, \a1, \a2, \a3, \b0, \b1, \b2, \b3, \t0, \t1, \t2, \t3, \a4, \a5, \a6, \a7, \b4, \b5, \b6, \b7, \t4, \t5, \t6, \t7, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, \z4, \l4, \h4, \z5, \l5, \h5, \z6, \l6, \h6, \z7, \l7, \h7, .4S, .S
+.endm
+
+.macro qq_butterfly_mixed_rev a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, a4, a5, a6, a7, b4, b5, b6, b7, t4, t5, t6, t7, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, z4, l4, h4, z5, l5, h5, z6, l6, h6, z7, l7, h7
+    wrap_qX_butterfly_mixed_rev \a0, \a1, \a2, \a3, \b0, \b1, \b2, \b3, \t0, \t1, \t2, \t3, \a4, \a5, \a6, \a7, \b4, \b5, \b6, \b7, \t4, \t5, \t6, \t7, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, \z4, \l4, \h4, \z5, \l5, \h5, \z6, \l6, \h6, \z7, \l7, \h7, .4S, .S
+.endm
+
+
+.macro qq_montgomery c0, c1, c2, c3, l0, l1, l2, l3, h0, h1, h2, h3, t0, t1, t2, t3, Qprime, Q
+    wrap_qX_montgomery \c0, \c1, \c2, \c3, \l0, \l1, \l2, \l3, \h0, \h1, \h2, \h3, \t0, \t1, \t2, \t3, \Qprime, \Q, .2S, .4S, .2D
+.endm
+
+.macro qq_sub_add s0, s1, s2, s3, t0, t1, t2, t3, a0, a1, a2, a3, b0, b1, b2, b3
+    wrap_qX_sub_add \s0, \s1, \s2, \s3, \t0, \t1, \t2, \t3, \a0, \a1, \a2, \a3, \b0, \b1, \b2, \b3, .4S
+.endm

src/sign/dilithium/dilithium2/aarch64/macros_common.inc

@@ -0,0 +1,423 @@
+// for ABI
+
+.macro push_all
+
+    sub sp, sp, #(16*9)
+    stp x19, x20, [sp, #16*0]
+    stp x21, x22, [sp, #16*1]
+    stp x23, x24, [sp, #16*2]
+    stp x25, x26, [sp, #16*3]
+    stp x27, x28, [sp, #16*4]
+    stp  d8,  d9, [sp, #16*5]
+    stp d10, d11, [sp, #16*6]
+    stp d12, d13, [sp, #16*7]
+    stp d14, d15, [sp, #16*8]
+
+.endm
+
+.macro pop_all
+
+    ldp x19, x20, [sp, #16*0]
+    ldp x21, x22, [sp, #16*1]
+    ldp x23, x24, [sp, #16*2]
+    ldp x25, x26, [sp, #16*3]
+    ldp x27, x28, [sp, #16*4]
+    ldp  d8,  d9, [sp, #16*5]
+    ldp d10, d11, [sp, #16*6]
+    ldp d12, d13, [sp, #16*7]
+    ldp d14, d15, [sp, #16*8]
+    add sp, sp, #(16*9)
+
+.endm
+
+// vector-scalar butterflies
+
+.macro wrap_dX_butterfly_top a0, a1, b0, b1, t0, t1, mod, z0, l0, h0, z1, l1, h1, wX, nX
+
+    mul      \t0\wX, \b0\wX, \z0\nX[\h0]
+    mul      \t1\wX, \b1\wX, \z1\nX[\h1]
+
+    sqrdmulh \b0\wX, \b0\wX, \z0\nX[\l0]
+    sqrdmulh \b1\wX, \b1\wX, \z1\nX[\l1]
+
+    mls      \t0\wX, \b0\wX, \mod\nX[0]
+    mls      \t1\wX, \b1\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_dX_butterfly_bot a0, a1, b0, b1, t0, t1, mod, z0, l0, h0, z1, l1, h1, wX, nX
+
+    sub     \b0\wX, \a0\wX, \t0\wX
+    sub     \b1\wX, \a1\wX, \t1\wX
+
+    add     \a0\wX, \a0\wX, \t0\wX
+    add     \a1\wX, \a1\wX, \t1\wX
+
+.endm
+
+.macro wrap_dX_butterfly_mixed a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, wX, nX
+
+    sub      \b0\wX, \a0\wX, \t0\wX
+    mul      \t2\wX, \b2\wX, \z2\nX[\h2]
+    sub      \b1\wX, \a1\wX, \t1\wX
+    mul      \t3\wX, \b3\wX, \z3\nX[\h3]
+
+    add      \a0\wX, \a0\wX, \t0\wX
+    sqrdmulh \b2\wX, \b2\wX, \z2\nX[\l2]
+    add      \a1\wX, \a1\wX, \t1\wX
+    sqrdmulh \b3\wX, \b3\wX, \z3\nX[\l3]
+
+    mls      \t2\wX, \b2\wX, \mod\nX[0]
+    mls      \t3\wX, \b3\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_dX_butterfly_mixed_rev a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, wX, nX
+
+    mul      \t0\wX, \b0\wX, \z0\nX[\h0]
+    sub      \b2\wX, \a2\wX, \t2\wX
+    mul      \t1\wX, \b1\wX, \z1\nX[\h1]
+    sub      \b3\wX, \a3\wX, \t3\wX
+
+    sqrdmulh \b0\wX, \b0\wX, \z0\nX[\l0]
+    add      \a2\wX, \a2\wX, \t2\wX
+    sqrdmulh \b1\wX, \b1\wX, \z1\nX[\l1]
+    add      \a3\wX, \a3\wX, \t3\wX
+
+    mls      \t0\wX, \b0\wX, \mod\nX[0]
+    mls      \t1\wX, \b1\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_qX_butterfly_top a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, wX, nX
+
+    mul      \t0\wX, \b0\wX, \z0\nX[\h0]
+    mul      \t1\wX, \b1\wX, \z1\nX[\h1]
+    mul      \t2\wX, \b2\wX, \z2\nX[\h2]
+    mul      \t3\wX, \b3\wX, \z3\nX[\h3]
+
+    sqrdmulh \b0\wX, \b0\wX, \z0\nX[\l0]
+    sqrdmulh \b1\wX, \b1\wX, \z1\nX[\l1]
+    sqrdmulh \b2\wX, \b2\wX, \z2\nX[\l2]
+    sqrdmulh \b3\wX, \b3\wX, \z3\nX[\l3]
+
+    mls      \t0\wX, \b0\wX, \mod\nX[0]
+    mls      \t1\wX, \b1\wX, \mod\nX[0]
+    mls      \t2\wX, \b2\wX, \mod\nX[0]
+    mls      \t3\wX, \b3\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_qX_butterfly_bot a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, wX, nX
+
+    sub     \b0\wX, \a0\wX, \t0\wX
+    sub     \b1\wX, \a1\wX, \t1\wX
+    sub     \b2\wX, \a2\wX, \t2\wX
+    sub     \b3\wX, \a3\wX, \t3\wX
+
+    add     \a0\wX, \a0\wX, \t0\wX
+    add     \a1\wX, \a1\wX, \t1\wX
+    add     \a2\wX, \a2\wX, \t2\wX
+    add     \a3\wX, \a3\wX, \t3\wX
+
+.endm
+
+.macro wrap_qX_butterfly_mixed a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, a4, a5, a6, a7, b4, b5, b6, b7, t4, t5, t6, t7, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, z4, l4, h4, z5, l5, h5, z6, l6, h6, z7, l7, h7, wX, nX
+
+    sub      \b0\wX, \a0\wX, \t0\wX
+    mul      \t4\wX, \b4\wX, \z4\nX[\h4]
+    sub      \b1\wX, \a1\wX, \t1\wX
+    mul      \t5\wX, \b5\wX, \z5\nX[\h5]
+    sub      \b2\wX, \a2\wX, \t2\wX
+    mul      \t6\wX, \b6\wX, \z6\nX[\h6]
+    sub      \b3\wX, \a3\wX, \t3\wX
+    mul      \t7\wX, \b7\wX, \z7\nX[\h7]
+
+    add      \a0\wX, \a0\wX, \t0\wX
+    sqrdmulh \b4\wX, \b4\wX, \z4\nX[\l4]
+    add      \a1\wX, \a1\wX, \t1\wX
+    sqrdmulh \b5\wX, \b5\wX, \z5\nX[\l5]
+    add      \a2\wX, \a2\wX, \t2\wX
+    sqrdmulh \b6\wX, \b6\wX, \z6\nX[\l6]
+    add      \a3\wX, \a3\wX, \t3\wX
+    sqrdmulh \b7\wX, \b7\wX, \z7\nX[\l7]
+
+    mls      \t4\wX, \b4\wX, \mod\nX[0]
+    mls      \t5\wX, \b5\wX, \mod\nX[0]
+    mls      \t6\wX, \b6\wX, \mod\nX[0]
+    mls      \t7\wX, \b7\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_qX_butterfly_mixed_rev a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, a4, a5, a6, a7, b4, b5, b6, b7, t4, t5, t6, t7, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, z4, l4, h4, z5, l5, h5, z6, l6, h6, z7, l7, h7, wX, nX
+
+    mul      \t0\wX, \b0\wX, \z0\nX[\h0]
+    sub      \b4\wX, \a4\wX, \t4\wX
+    mul      \t1\wX, \b1\wX, \z1\nX[\h1]
+    sub      \b5\wX, \a5\wX, \t5\wX
+    mul      \t2\wX, \b2\wX, \z2\nX[\h2]
+    sub      \b6\wX, \a6\wX, \t6\wX
+    mul      \t3\wX, \b3\wX, \z3\nX[\h3]
+    sub      \b7\wX, \a7\wX, \t7\wX
+
+    sqrdmulh \b0\wX, \b0\wX, \z0\nX[\l0]
+    add      \a4\wX, \a4\wX, \t4\wX
+    sqrdmulh \b1\wX, \b1\wX, \z1\nX[\l1]
+    add      \a5\wX, \a5\wX, \t5\wX
+    sqrdmulh \b2\wX, \b2\wX, \z2\nX[\l2]
+    add      \a6\wX, \a6\wX, \t6\wX
+    sqrdmulh \b3\wX, \b3\wX, \z3\nX[\l3]
+    add      \a7\wX, \a7\wX, \t7\wX
+
+    mls      \t0\wX, \b0\wX, \mod\nX[0]
+    mls      \t1\wX, \b1\wX, \mod\nX[0]
+    mls      \t2\wX, \b2\wX, \mod\nX[0]
+    mls      \t3\wX, \b3\wX, \mod\nX[0]
+
+.endm
+
+// vector-vector butterflies
+
+.macro wrap_dX_butterfly_vec_top a0, a1, b0, b1, t0, t1, mod, l0, h0, l1, h1, wX, nX
+
+    mul      \t0\wX, \b0\wX, \h0\wX
+    mul      \t1\wX, \b1\wX, \h1\wX
+
+    sqrdmulh \b0\wX, \b0\wX, \l0\wX
+    sqrdmulh \b1\wX, \b1\wX, \l1\wX
+
+    mls      \t0\wX, \b0\wX, \mod\nX[0]
+    mls      \t1\wX, \b1\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_dX_butterfly_vec_bot a0, a1, b0, b1, t0, t1, mod, l0, h0, l1, h1, wX, nX
+
+    sub     \b0\wX, \a0\wX, \t0\wX
+    sub     \b1\wX, \a1\wX, \t1\wX
+
+    add     \a0\wX, \a0\wX, \t0\wX
+    add     \a1\wX, \a1\wX, \t1\wX
+
+.endm
+
+.macro wrap_dX_butterfly_vec_mixed a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, l0, h0, l1, h1, l2, h2, l3, h3, wX, nX
+
+    sub      \b0\wX, \a0\wX, \t0\wX
+    mul      \t2\wX, \b2\wX, \h2\wX
+    sub      \b1\wX, \a1\wX, \t1\wX
+    mul      \t3\wX, \b3\wX, \h3\wX
+
+    add      \a0\wX, \a0\wX, \t0\wX
+    sqrdmulh \b2\wX, \b2\wX, \l2\wX
+    add      \a1\wX, \a1\wX, \t1\wX
+    sqrdmulh \b3\wX, \b3\wX, \l3\wX
+
+    mls      \t2\wX, \b2\wX, \mod\nX[0]
+    mls      \t3\wX, \b3\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_dX_butterfly_vec_mixed_rev a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, l0, h0, l1, h1, l2, h2, l3, h3, wX, nX
+
+    mul      \t0\wX, \b0\wX, \h0\wX
+    sub      \b2\wX, \a2\wX, \t2\wX
+    mul      \t1\wX, \b1\wX, \h1\wX
+    sub      \b3\wX, \a3\wX, \t3\wX
+
+    sqrdmulh \b0\wX, \b0\wX, \l0\wX
+    add      \a2\wX, \a2\wX, \t2\wX
+    sqrdmulh \b1\wX, \b1\wX, \l1\wX
+    add      \a3\wX, \a3\wX, \t3\wX
+
+    mls      \t0\wX, \b0\wX, \mod\nX[0]
+    mls      \t1\wX, \b1\wX, \mod\nX[0]
+
+.endm
+
+// vector-scalar Barrett reduction
+
+.macro wrap_qX_barrett a0, a1, a2, a3, t0, t1, t2, t3, barrett_const, shrv, Q, wX, nX
+
+    sqdmulh \t0\wX, \a0\wX, \barrett_const\nX[0]
+    sqdmulh \t1\wX, \a1\wX, \barrett_const\nX[0]
+
+    sqdmulh \t2\wX, \a2\wX, \barrett_const\nX[0]
+    srshr   \t0\wX, \t0\wX, \shrv
+    sqdmulh \t3\wX, \a3\wX, \barrett_const\nX[0]
+    srshr   \t1\wX, \t1\wX, \shrv
+
+    srshr   \t2\wX, \t2\wX, \shrv
+    mls     \a0\wX, \t0\wX, \Q\wX
+    srshr   \t3\wX, \t3\wX, \shrv
+    mls     \a1\wX, \t1\wX, \Q\wX
+
+    mls     \a2\wX, \t2\wX, \Q\wX
+    mls     \a3\wX, \t3\wX, \Q\wX
+
+.endm
+
+.macro wrap_oX_barrett a0, a1, a2, a3, t0, t1, t2, t3, a4, a5, a6, a7, t4, t5, t6, t7, barrett_const, shrv, Q, wX, nX
+
+    sqdmulh \t0\wX, \a0\wX, \barrett_const\nX[0]
+    sqdmulh \t1\wX, \a1\wX, \barrett_const\nX[0]
+    sqdmulh \t2\wX, \a2\wX, \barrett_const\nX[0]
+    sqdmulh \t3\wX, \a3\wX, \barrett_const\nX[0]
+
+    srshr   \t0\wX, \t0\wX, \shrv
+    sqdmulh \t4\wX, \a4\wX, \barrett_const\nX[0]
+    srshr   \t1\wX, \t1\wX, \shrv
+    sqdmulh \t5\wX, \a5\wX, \barrett_const\nX[0]
+    srshr   \t2\wX, \t2\wX, \shrv
+    sqdmulh \t6\wX, \a6\wX, \barrett_const\nX[0]
+    srshr   \t3\wX, \t3\wX, \shrv
+    sqdmulh \t7\wX, \a7\wX, \barrett_const\nX[0]
+
+    mls     \a0\wX, \t0\wX, \Q\wX
+    srshr   \t4\wX, \t4\wX, \shrv
+    mls     \a1\wX, \t1\wX, \Q\wX
+    srshr   \t5\wX, \t5\wX, \shrv
+    mls     \a2\wX, \t2\wX, \Q\wX
+    srshr   \t6\wX, \t6\wX, \shrv
+    mls     \a3\wX, \t3\wX, \Q\wX
+    srshr   \t7\wX, \t7\wX, \shrv
+
+    mls     \a4\wX, \t4\wX, \Q\wX
+    mls     \a5\wX, \t5\wX, \Q\wX
+    mls     \a6\wX, \t6\wX, \Q\wX
+    mls     \a7\wX, \t7\wX, \Q\wX
+
+.endm
+
+// vector-vector Barrett reduction
+
+.macro wrap_qo_barrett_vec a0, a1, a2, a3, t0, t1, t2, t3, barrett_const, shrv, Q, wX, nX
+
+    sqdmulh \t0\wX, \a0\wX, \barrett_const\wX
+    sqdmulh \t1\wX, \a1\wX, \barrett_const\wX
+
+    sqdmulh \t2\wX, \a2\wX, \barrett_const\wX
+    srshr   \t0\wX, \t0\wX, \shrv
+    sqdmulh \t3\wX, \a3\wX, \barrett_const\wX
+    srshr   \t1\wX, \t1\wX, \shrv
+
+    srshr   \t2\wX, \t2\wX, \shrv
+    mls     \a0\wX, \t0\wX, \Q\wX
+    srshr   \t3\wX, \t3\wX, \shrv
+    mls     \a1\wX, \t1\wX, \Q\wX
+
+    mls     \a2\wX, \t2\wX, \Q\wX
+    mls     \a3\wX, \t3\wX, \Q\wX
+
+.endm
+
+.macro wrap_oo_barrett_vec a0, a1, a2, a3, t0, t1, t2, t3, a4, a5, a6, a7, t4, t5, t6, t7, barrett_const, shrv, Q, wX, nX
+
+    sqdmulh \t0\wX, \a0\wX, \barrett_const\wX
+    sqdmulh \t1\wX, \a1\wX, \barrett_const\wX
+    sqdmulh \t2\wX, \a2\wX, \barrett_const\wX
+    sqdmulh \t3\wX, \a3\wX, \barrett_const\wX
+
+    srshr   \t0\wX, \t0\wX, \shrv
+    sqdmulh \t4\wX, \a4\wX, \barrett_const\wX
+    srshr   \t1\wX, \t1\wX, \shrv
+    sqdmulh \t5\wX, \a5\wX, \barrett_const\wX
+    srshr   \t2\wX, \t2\wX, \shrv
+    sqdmulh \t6\wX, \a6\wX, \barrett_const\wX
+    srshr   \t3\wX, \t3\wX, \shrv
+    sqdmulh \t7\wX, \a7\wX, \barrett_const\wX
+
+    mls     \a0\wX, \t0\wX, \Q\wX
+    srshr   \t4\wX, \t4\wX, \shrv
+    mls     \a1\wX, \t1\wX, \Q\wX
+    srshr   \t5\wX, \t5\wX, \shrv
+    mls     \a2\wX, \t2\wX, \Q\wX
+    srshr   \t6\wX, \t6\wX, \shrv
+    mls     \a3\wX, \t3\wX, \Q\wX
+    srshr   \t7\wX, \t7\wX, \shrv
+
+    mls     \a4\wX, \t4\wX, \Q\wX
+    mls     \a5\wX, \t5\wX, \Q\wX
+    mls     \a6\wX, \t6\wX, \Q\wX
+    mls     \a7\wX, \t7\wX, \Q\wX
+
+.endm
+
+// Montgomery multiplication
+
+.macro wrap_qX_montgomery_mul b0, b1, b2, b3, t0, t1, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, wX, nX
+
+    mul      \b0\wX, \t0\wX, \z0\nX[\h0]
+    mul      \b1\wX, \t1\wX, \z1\nX[\h1]
+    mul      \b2\wX, \t2\wX, \z2\nX[\h2]
+    mul      \b3\wX, \t3\wX, \z3\nX[\h3]
+
+    sqrdmulh \t0\wX, \t0\wX, \z0\nX[\l0]
+    sqrdmulh \t1\wX, \t1\wX, \z1\nX[\l1]
+    sqrdmulh \t2\wX, \t2\wX, \z2\nX[\l2]
+    sqrdmulh \t3\wX, \t3\wX, \z3\nX[\l3]
+
+    mls      \b0\wX, \t0\wX, \mod\nX[0]
+    mls      \b1\wX, \t1\wX, \mod\nX[0]
+    mls      \b2\wX, \t2\wX, \mod\nX[0]
+    mls      \b3\wX, \t3\wX, \mod\nX[0]
+
+.endm
+
+// Montgomery reduction with long
+
+.macro wrap_qX_montgomery c0, c1, c2, c3, l0, l1, l2, l3, h0, h1, h2, h3, t0, t1, t2, t3, Qprime, Q, lX, wX, dwX
+
+    uzp1 \t0\wX, \l0\wX, \h0\wX
+    uzp1 \t1\wX, \l1\wX, \h1\wX
+    uzp1 \t2\wX, \l2\wX, \h2\wX
+    uzp1 \t3\wX, \l3\wX, \h3\wX
+
+    mul \t0\wX, \t0\wX, \Qprime\wX
+    mul \t1\wX, \t1\wX, \Qprime\wX
+    mul \t2\wX, \t2\wX, \Qprime\wX
+    mul \t3\wX, \t3\wX, \Qprime\wX
+
+    smlal  \l0\dwX, \t0\lX, \Q\lX
+    smlal2 \h0\dwX, \t0\wX, \Q\wX
+    smlal  \l1\dwX, \t1\lX, \Q\lX
+    smlal2 \h1\dwX, \t1\wX, \Q\wX
+    smlal  \l2\dwX, \t2\lX, \Q\lX
+    smlal2 \h2\dwX, \t2\wX, \Q\wX
+    smlal  \l3\dwX, \t3\lX, \Q\lX
+    smlal2 \h3\dwX, \t3\wX, \Q\wX
+
+    uzp2 \c0\wX, \l0\wX, \h0\wX
+    uzp2 \c1\wX, \l1\wX, \h1\wX
+    uzp2 \c2\wX, \l2\wX, \h2\wX
+    uzp2 \c3\wX, \l3\wX, \h3\wX
+
+.endm
+
+// add_sub, sub_add
+
+.macro wrap_qX_add_sub s0, s1, s2, s3, t0, t1, t2, t3, a0, a1, a2, a3, b0, b1, b2, b3, wX
+
+    add \s0\wX, \a0\wX, \b0\wX
+    sub \t0\wX, \a0\wX, \b0\wX
+    add \s1\wX, \a1\wX, \b1\wX
+    sub \t1\wX, \a1\wX, \b1\wX
+    add \s2\wX, \a2\wX, \b2\wX
+    sub \t2\wX, \a2\wX, \b2\wX
+    add \s3\wX, \a3\wX, \b3\wX
+    sub \t3\wX, \a3\wX, \b3\wX
+
+.endm
+
+.macro wrap_qX_sub_add s0, s1, s2, s3, t0, t1, t2, t3, a0, a1, a2, a3, b0, b1, b2, b3, wX
+
+    sub \t0\wX, \a0\wX, \b0\wX
+    add \s0\wX, \a0\wX, \b0\wX
+    sub \t1\wX, \a1\wX, \b1\wX
+    add \s1\wX, \a1\wX, \b1\wX
+    sub \t2\wX, \a2\wX, \b2\wX
+    add \s2\wX, \a2\wX, \b2\wX
+    sub \t3\wX, \a3\wX, \b3\wX
+    add \s3\wX, \a3\wX, \b3\wX
+
+.endm

src/sign/dilithium/dilithium2/aarch64/ntt.c

@@ -0,0 +1,35 @@
+#include "params.h"
+#include "reduce.h"
+#include <stdint.h>
+#include <stdio.h>
+
+#include "NTT_params.h"
+#include "ntt.h"
+
+
+/*************************************************
+* Name:        ntt
+*
+* Description: Forward NTT, in-place. No modular reduction is performed after
+*              additions or subtractions. Output vector is in bitreversed order.
+*
+* Arguments:   - uint32_t p[N]: input/output coefficient array
+**************************************************/
+void ntt(int32_t a[N]) {
+    NTT(a);
+}
+
+/*************************************************
+* Name:        invntt_tomont
+*
+* Description: Inverse NTT and multiplication by Montgomery factor 2^32.
+*              In-place. No modular reductions after additions or
+*              subtractions; input coefficients need to be smaller than
+*              Q in absolute value. Output coefficient are smaller than Q in
+*              absolute value.
+*
+* Arguments:   - uint32_t p[N]: input/output coefficient array
+**************************************************/
+void invntt_tomont(int32_t a[N]) {
+    iNTT(a);
+}

src/sign/dilithium/dilithium2/aarch64/packing.c

@@ -0,0 +1,261 @@
+#include "packing.h"
+#include "params.h"
+#include "poly.h"
+#include "polyvec.h"
+
+
+/*************************************************
+* Name:        pack_pk
+*
+* Description: Bit-pack public key pk = (rho, t1).
+*
+* Arguments:   - uint8_t pk[]: output byte array
+*              - const uint8_t rho[]: byte array containing rho
+*              - const polyveck *t1: pointer to vector t1
+**************************************************/
+void pack_pk(uint8_t pk[CRYPTO_PUBLICKEYBYTES],
+             const uint8_t rho[SEEDBYTES],
+             const polyveck *t1) {
+    unsigned int i;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        pk[i] = rho[i];
+    }
+    pk += SEEDBYTES;
+
+    for (i = 0; i < K; ++i) {
+        polyt1_pack(pk + i * POLYT1_PACKEDBYTES, &t1->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        unpack_pk
+*
+* Description: Unpack public key pk = (rho, t1).
+*
+* Arguments:   - const uint8_t rho[]: output byte array for rho
+*              - const polyveck *t1: pointer to output vector t1
+*              - uint8_t pk[]: byte array containing bit-packed pk
+**************************************************/
+void unpack_pk(uint8_t rho[SEEDBYTES],
+               polyveck *t1,
+               const uint8_t pk[CRYPTO_PUBLICKEYBYTES]) {
+    unsigned int i;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        rho[i] = pk[i];
+    }
+    pk += SEEDBYTES;
+
+    for (i = 0; i < K; ++i) {
+        polyt1_unpack(&t1->vec[i], pk + i * POLYT1_PACKEDBYTES);
+    }
+}
+
+/*************************************************
+* Name:        pack_sk
+*
+* Description: Bit-pack secret key sk = (rho, tr, key, t0, s1, s2).
+*
+* Arguments:   - uint8_t sk[]: output byte array
+*              - const uint8_t rho[]: byte array containing rho
+*              - const uint8_t tr[]: byte array containing tr
+*              - const uint8_t key[]: byte array containing key
+*              - const polyveck *t0: pointer to vector t0
+*              - const polyvecl *s1: pointer to vector s1
+*              - const polyveck *s2: pointer to vector s2
+**************************************************/
+void pack_sk(uint8_t sk[CRYPTO_SECRETKEYBYTES],
+             const uint8_t rho[SEEDBYTES],
+             const uint8_t tr[SEEDBYTES],
+             const uint8_t key[SEEDBYTES],
+             const polyveck *t0,
+             const polyvecl *s1,
+             const polyveck *s2) {
+    unsigned int i;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        sk[i] = rho[i];
+    }
+    sk += SEEDBYTES;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        sk[i] = key[i];
+    }
+    sk += SEEDBYTES;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        sk[i] = tr[i];
+    }
+    sk += SEEDBYTES;
+
+    for (i = 0; i < L; ++i) {
+        polyeta_pack(sk + i * POLYETA_PACKEDBYTES, &s1->vec[i]);
+    }
+    sk += L * POLYETA_PACKEDBYTES;
+
+    for (i = 0; i < K; ++i) {
+        polyeta_pack(sk + i * POLYETA_PACKEDBYTES, &s2->vec[i]);
+    }
+    sk += K * POLYETA_PACKEDBYTES;
+
+    for (i = 0; i < K; ++i) {
+        polyt0_pack(sk + i * POLYT0_PACKEDBYTES, &t0->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        unpack_sk
+*
+* Description: Unpack secret key sk = (rho, tr, key, t0, s1, s2).
+*
+* Arguments:   - const uint8_t rho[]: output byte array for rho
+*              - const uint8_t tr[]: output byte array for tr
+*              - const uint8_t key[]: output byte array for key
+*              - const polyveck *t0: pointer to output vector t0
+*              - const polyvecl *s1: pointer to output vector s1
+*              - const polyveck *s2: pointer to output vector s2
+*              - uint8_t sk[]: byte array containing bit-packed sk
+**************************************************/
+void unpack_sk(uint8_t rho[SEEDBYTES],
+               uint8_t tr[SEEDBYTES],
+               uint8_t key[SEEDBYTES],
+               polyveck *t0,
+               polyvecl *s1,
+               polyveck *s2,
+               const uint8_t sk[CRYPTO_SECRETKEYBYTES]) {
+    unsigned int i;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        rho[i] = sk[i];
+    }
+    sk += SEEDBYTES;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        key[i] = sk[i];
+    }
+    sk += SEEDBYTES;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        tr[i] = sk[i];
+    }
+    sk += SEEDBYTES;
+
+    for (i = 0; i < L; ++i) {
+        polyeta_unpack(&s1->vec[i], sk + i * POLYETA_PACKEDBYTES);
+    }
+    sk += L * POLYETA_PACKEDBYTES;
+
+    for (i = 0; i < K; ++i) {
+        polyeta_unpack(&s2->vec[i], sk + i * POLYETA_PACKEDBYTES);
+    }
+    sk += K * POLYETA_PACKEDBYTES;
+
+    for (i = 0; i < K; ++i) {
+        polyt0_unpack(&t0->vec[i], sk + i * POLYT0_PACKEDBYTES);
+    }
+}
+
+/*************************************************
+* Name:        pack_sig
+*
+* Description: Bit-pack signature sig = (c, z, h).
+*
+* Arguments:   - uint8_t sig[]: output byte array
+*              - const uint8_t *c: pointer to challenge hash length SEEDBYTES
+*              - const polyvecl *z: pointer to vector z
+*              - const polyveck *h: pointer to hint vector h
+**************************************************/
+void pack_sig(uint8_t sig[CRYPTO_BYTES],
+              const uint8_t c[SEEDBYTES],
+              const polyvecl *z,
+              const polyveck *h) {
+    unsigned int i, j, k;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        sig[i] = c[i];
+    }
+    sig += SEEDBYTES;
+
+    for (i = 0; i < L; ++i) {
+        polyz_pack(sig + i * POLYZ_PACKEDBYTES, &z->vec[i]);
+    }
+    sig += L * POLYZ_PACKEDBYTES;
+
+    /* Encode h */
+    for (i = 0; i < OMEGA + K; ++i) {
+        sig[i] = 0;
+    }
+
+    k = 0;
+    for (i = 0; i < K; ++i) {
+        for (j = 0; j < N; ++j) {
+            if (h->vec[i].coeffs[j] != 0) {
+                sig[k++] = (uint8_t) j;
+            }
+        }
+
+        sig[OMEGA + i] = (uint8_t) k;
+    }
+}
+
+/*************************************************
+* Name:        unpack_sig
+*
+* Description: Unpack signature sig = (c, z, h).
+*
+* Arguments:   - uint8_t *c: pointer to output challenge hash
+*              - polyvecl *z: pointer to output vector z
+*              - polyveck *h: pointer to output hint vector h
+*              - const uint8_t sig[]: byte array containing
+*                bit-packed signature
+*
+* Returns 1 in case of malformed signature; otherwise 0.
+**************************************************/
+int unpack_sig(uint8_t c[SEEDBYTES],
+               polyvecl *z,
+               polyveck *h,
+               const uint8_t sig[CRYPTO_BYTES]) {
+    unsigned int i, j, k;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        c[i] = sig[i];
+    }
+    sig += SEEDBYTES;
+
+    for (i = 0; i < L; ++i) {
+        polyz_unpack(&z->vec[i], sig + i * POLYZ_PACKEDBYTES);
+    }
+    sig += L * POLYZ_PACKEDBYTES;
+
+    /* Decode h */
+    k = 0;
+    for (i = 0; i < K; ++i) {
+        for (j = 0; j < N; ++j) {
+            h->vec[i].coeffs[j] = 0;
+        }
+
+        if (sig[OMEGA + i] < k || sig[OMEGA + i] > OMEGA) {
+            return 1;
+        }
+
+        for (j = k; j < sig[OMEGA + i]; ++j) {
+            /* Coefficients are ordered for strong unforgeability */
+            if (j > k && sig[j] <= sig[j - 1]) {
+                return 1;
+            }
+            h->vec[i].coeffs[sig[j]] = 1;
+        }
+
+        k = sig[OMEGA + i];
+    }
+
+    /* Extra indices are zero for strong unforgeability */
+    for (j = k; j < OMEGA; ++j) {
+        if (sig[j]) {
+            return 1;
+        }
+    }
+
+    return 0;
+}

src/sign/dilithium/dilithium2/aarch64/packing.h

@@ -0,0 +1,37 @@
+#ifndef PACKING_H
+#define PACKING_H
+#include "params.h"
+#include "polyvec.h"
+#include <stdint.h>
+
+#define pack_pk DILITHIUM_NAMESPACE(pack_pk)
+void pack_pk(uint8_t pk[CRYPTO_PUBLICKEYBYTES], const uint8_t rho[SEEDBYTES], const polyveck *t1);
+
+#define pack_sk DILITHIUM_NAMESPACE(pack_sk)
+void pack_sk(uint8_t sk[CRYPTO_SECRETKEYBYTES],
+             const uint8_t rho[SEEDBYTES],
+             const uint8_t tr[SEEDBYTES],
+             const uint8_t key[SEEDBYTES],
+             const polyveck *t0,
+             const polyvecl *s1,
+             const polyveck *s2);
+
+#define pack_sig DILITHIUM_NAMESPACE(pack_sig)
+void pack_sig(uint8_t sig[CRYPTO_BYTES], const uint8_t c[SEEDBYTES], const polyvecl *z, const polyveck *h);
+
+#define unpack_pk DILITHIUM_NAMESPACE(unpack_pk)
+void unpack_pk(uint8_t rho[SEEDBYTES], polyveck *t1, const uint8_t pk[CRYPTO_PUBLICKEYBYTES]);
+
+#define unpack_sk DILITHIUM_NAMESPACE(unpack_sk)
+void unpack_sk(uint8_t rho[SEEDBYTES],
+               uint8_t tr[SEEDBYTES],
+               uint8_t key[SEEDBYTES],
+               polyveck *t0,
+               polyvecl *s1,
+               polyveck *s2,
+               const uint8_t sk[CRYPTO_SECRETKEYBYTES]);
+
+#define unpack_sig DILITHIUM_NAMESPACE(unpack_sig)
+int unpack_sig(uint8_t c[SEEDBYTES], polyvecl *z, polyveck *h, const uint8_t sig[CRYPTO_BYTES]);
+
+#endif

src/sign/dilithium/dilithium2/aarch64/params.h

@@ -0,0 +1,51 @@
+#ifndef PARAMS_H
+#define PARAMS_H
+
+#define DILITHIUM_MODE 2
+//#define DILITHIUM_MODE 3
+//#define DILITHIUM_MODE 5
+
+#define CRYPTO_NAMESPACETOP PQCLEAN_DILITHIUM2_AARCH64_crypto_sign
+#define CRYPTO_NAMESPACE(s) PQCLEAN_DILITHIUM2_AARCH64_##s
+#define DILITHIUM_NAMESPACETOP CRYPTO_NAMESPACETOP
+#define DILITHIUM_NAMESPACE(s) CRYPTO_NAMESPACE(s)
+
+
+#define SEEDBYTES 32
+#define CRHBYTES 64
+#define N 256
+#define DILITHIUM_Q 8380417
+#define D 13
+#define ROOT_OF_UNITY 1753
+
+
+#define K 4
+#define L 4
+#define ETA 2
+#define TAU 39
+#define BETA 78
+#define GAMMA1 (1 << 17)
+#define GAMMA2 ((DILITHIUM_Q-1)/88)
+#define OMEGA 80
+#define CRYPTO_ALGNAME "Dilithium2"
+
+
+#define POLYT1_PACKEDBYTES  320
+#define POLYT0_PACKEDBYTES  416
+#define POLYVECH_PACKEDBYTES (OMEGA + K)
+
+
+#define POLYZ_PACKEDBYTES   576
+
+#define POLYW1_PACKEDBYTES  192
+
+#define POLYETA_PACKEDBYTES  96
+
+#define CRYPTO_PUBLICKEYBYTES (SEEDBYTES + K*POLYT1_PACKEDBYTES)
+#define CRYPTO_SECRETKEYBYTES (3*SEEDBYTES \
+                               + L*POLYETA_PACKEDBYTES \
+                               + K*POLYETA_PACKEDBYTES \
+                               + K*POLYT0_PACKEDBYTES)
+#define CRYPTO_BYTES (SEEDBYTES + L*POLYZ_PACKEDBYTES + POLYVECH_PACKEDBYTES)
+
+#endif

src/sign/dilithium/dilithium2/aarch64/poly.c

@@ -0,0 +1,940 @@
+#include "params.h"
+#include "poly.h"
+#include "reduce.h"
+#include "rounding.h"
+#include "symmetric.h"
+#include <stdint.h>
+
+#include "fips202x2.h"
+
+#include "NTT_params.h"
+#include "ntt.h"
+
+static const int32_t montgomery_const[4] = {
+    DILITHIUM_Q, DILITHIUM_QINV
+};
+
+#define DBENCH_START()
+#define DBENCH_STOP(t)
+
+/*************************************************
+* Name:        poly_reduce
+*
+* Description: Inplace reduction of all coefficients of polynomial to
+*              representative in [-6283009,6283007].
+*
+* Arguments:   - poly *a: pointer to input/output polynomial
+**************************************************/
+extern void PQCLEAN_DILITHIUM2_AARCH64_asm_poly_reduce(int32_t *, const int32_t *);
+void poly_reduce(poly *a) {
+    DBENCH_START();
+
+    PQCLEAN_DILITHIUM2_AARCH64_asm_poly_reduce(a->coeffs, montgomery_const);
+
+    DBENCH_STOP(*tred);
+}
+
+/*************************************************
+* Name:        poly_caddq
+*
+* Description: For all coefficients of in/out polynomial add Q if
+*              coefficient is negative.
+*
+* Arguments:   - poly *a: pointer to input/output polynomial
+**************************************************/
+extern void PQCLEAN_DILITHIUM2_AARCH64_asm_poly_caddq(int32_t *, const int32_t *);
+void poly_caddq(poly *a) {
+    DBENCH_START();
+
+    PQCLEAN_DILITHIUM2_AARCH64_asm_poly_caddq(a->coeffs, montgomery_const);
+
+    DBENCH_STOP(*tred);
+}
+
+/*************************************************
+* Name:        poly_freeze
+*
+* Description: Inplace reduction of all coefficients of polynomial to
+*              standard representatives.
+*
+* Arguments:   - poly *a: pointer to input/output polynomial
+**************************************************/
+extern void PQCLEAN_DILITHIUM2_AARCH64_asm_poly_freeze(int32_t *, const int32_t *);
+void poly_freeze(poly *a) {
+    DBENCH_START();
+
+    PQCLEAN_DILITHIUM2_AARCH64_asm_poly_freeze(a->coeffs, montgomery_const);
+
+    DBENCH_STOP(*tred);
+}
+
+/*************************************************
+* Name:        poly_add
+*
+* Description: Add polynomials. No modular reduction is performed.
+*
+* Arguments:   - poly *c: pointer to output polynomial
+*              - const poly *a: pointer to first summand
+*              - const poly *b: pointer to second summand
+**************************************************/
+void poly_add(poly *c, const poly *a, const poly *b)  {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N; ++i) {
+        c->coeffs[i] = a->coeffs[i] + b->coeffs[i];
+    }
+
+    DBENCH_STOP(*tadd);
+}
+
+/*************************************************
+* Name:        poly_sub
+*
+* Description: Subtract polynomials. No modular reduction is
+*              performed.
+*
+* Arguments:   - poly *c: pointer to output polynomial
+*              - const poly *a: pointer to first input polynomial
+*              - const poly *b: pointer to second input polynomial to be
+*                               subtraced from first input polynomial
+**************************************************/
+void poly_sub(poly *c, const poly *a, const poly *b) {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N; ++i) {
+        c->coeffs[i] = a->coeffs[i] - b->coeffs[i];
+    }
+
+    DBENCH_STOP(*tadd);
+}
+
+/*************************************************
+* Name:        poly_shiftl
+*
+* Description: Multiply polynomial by 2^D without modular reduction. Assumes
+*              input coefficients to be less than 2^{31-D} in absolute value.
+*
+* Arguments:   - poly *a: pointer to input/output polynomial
+**************************************************/
+void poly_shiftl(poly *a) {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N; ++i) {
+        a->coeffs[i] <<= D;
+    }
+
+    DBENCH_STOP(*tmul);
+}
+
+/*************************************************
+* Name:        poly_ntt
+*
+* Description: Inplace forward NTT. Coefficients can grow by
+*              8*Q in absolute value.
+*
+* Arguments:   - poly *a: pointer to input/output polynomial
+**************************************************/
+void poly_ntt(poly *a) {
+    DBENCH_START();
+
+    ntt(a->coeffs);
+
+    DBENCH_STOP(*tmul);
+}
+
+/*************************************************
+* Name:        poly_invntt_tomont
+*
+* Description: Inplace inverse NTT and multiplication by 2^{32}.
+*              Input coefficients need to be less than Q in absolute
+*              value and output coefficients are again bounded by Q.
+*
+* Arguments:   - poly *a: pointer to input/output polynomial
+**************************************************/
+void poly_invntt_tomont(poly *a) {
+    DBENCH_START();
+
+    invntt_tomont(a->coeffs);
+
+    DBENCH_STOP(*tmul);
+}
+
+/*************************************************
+* Name:        poly_pointwise_montgomery
+*
+* Description: Pointwise multiplication of polynomials in NTT domain
+*              representation and multiplication of resulting polynomial
+*              by 2^{-32}.
+*
+* Arguments:   - poly *c: pointer to output polynomial
+*              - const poly *a: pointer to first input polynomial
+*              - const poly *b: pointer to second input polynomial
+**************************************************/
+extern void PQCLEAN_DILITHIUM2_AARCH64_asm_poly_pointwise_montgomery(int32_t *des, const int32_t *src1, const int32_t *src2, const int32_t *table);
+void poly_pointwise_montgomery(poly *c, const poly *a, const poly *b) {
+    DBENCH_START();
+
+    PQCLEAN_DILITHIUM2_AARCH64_asm_poly_pointwise_montgomery(c->coeffs, a->coeffs, b->coeffs, montgomery_const);
+
+    DBENCH_STOP(*tmul);
+}
+
+/*************************************************
+* Name:        poly_power2round
+*
+* Description: For all coefficients c of the input polynomial,
+*              compute c0, c1 such that c mod Q = c1*2^D + c0
+*              with -2^{D-1} < c0 <= 2^{D-1}. Assumes coefficients to be
+*              standard representatives.
+*
+* Arguments:   - poly *a1: pointer to output polynomial with coefficients c1
+*              - poly *a0: pointer to output polynomial with coefficients c0
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+extern void PQCLEAN_DILITHIUM2_AARCH64_asm_poly_power2round(int32_t *, int32_t *, const int32_t *);
+void poly_power2round(poly *a1, poly *a0, const poly *a) {
+    DBENCH_START();
+
+    PQCLEAN_DILITHIUM2_AARCH64_asm_poly_power2round(a1->coeffs, a0->coeffs, a->coeffs);
+
+    DBENCH_STOP(*tround);
+}
+
+/*************************************************
+* Name:        poly_decompose
+*
+* Description: For all coefficients c of the input polynomial,
+*              compute high and low bits c0, c1 such c mod Q = c1*ALPHA + c0
+*              with -ALPHA/2 < c0 <= ALPHA/2 except c1 = (Q-1)/ALPHA where we
+*              set c1 = 0 and -ALPHA/2 <= c0 = c mod Q - Q < 0.
+*              Assumes coefficients to be standard representatives.
+*
+* Arguments:   - poly *a1: pointer to output polynomial with coefficients c1
+*              - poly *a0: pointer to output polynomial with coefficients c0
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+void poly_decompose(poly *a1, poly *a0, const poly *a) {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N; ++i) {
+        a1->coeffs[i] = decompose(&a0->coeffs[i], a->coeffs[i]);
+    }
+
+    DBENCH_STOP(*tround);
+}
+
+/*************************************************
+* Name:        poly_make_hint
+*
+* Description: Compute hint polynomial. The coefficients of which indicate
+*              whether the low bits of the corresponding coefficient of
+*              the input polynomial overflow into the high bits.
+*
+* Arguments:   - poly *h: pointer to output hint polynomial
+*              - const poly *a0: pointer to low part of input polynomial
+*              - const poly *a1: pointer to high part of input polynomial
+*
+* Returns number of 1 bits.
+**************************************************/
+unsigned int poly_make_hint(poly *h, const poly *a0, const poly *a1) {
+    unsigned int i, s = 0;
+    DBENCH_START();
+
+    for (i = 0; i < N; ++i) {
+        h->coeffs[i] = make_hint(a0->coeffs[i], a1->coeffs[i]);
+        s += h->coeffs[i];
+    }
+
+    DBENCH_STOP(*tround);
+    return s;
+}
+
+/*************************************************
+* Name:        poly_use_hint
+*
+* Description: Use hint polynomial to correct the high bits of a polynomial.
+*
+* Arguments:   - poly *b: pointer to output polynomial with corrected high bits
+*              - const poly *a: pointer to input polynomial
+*              - const poly *h: pointer to input hint polynomial
+**************************************************/
+void poly_use_hint(poly *b, const poly *a, const poly *h) {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N; ++i) {
+        b->coeffs[i] = use_hint(a->coeffs[i], h->coeffs[i]);
+    }
+
+    DBENCH_STOP(*tround);
+}
+
+/*************************************************
+* Name:        poly_chknorm
+*
+* Description: Check infinity norm of polynomial against given bound.
+*              Assumes input coefficients were reduced by reduce32().
+*
+* Arguments:   - const poly *a: pointer to polynomial
+*              - int32_t B: norm bound
+*
+* Returns 0 if norm is strictly smaller than B <= (Q-1)/8 and 1 otherwise.
+**************************************************/
+int poly_chknorm(const poly *a, int32_t B) {
+    unsigned int i;
+    int32_t t;
+    DBENCH_START();
+
+    if (B > (DILITHIUM_Q - 1) / 8) {
+        return 1;
+    }
+
+    /* It is ok to leak which coefficient violates the bound since
+       the probability for each coefficient is independent of secret
+       data but we must not leak the sign of the centralized representative. */
+    for (i = 0; i < N; ++i) {
+        /* Absolute value */
+        t = a->coeffs[i] >> 31;
+        t = a->coeffs[i] - (t & 2 * a->coeffs[i]);
+
+        if (t >= B) {
+            DBENCH_STOP(*tsample);
+            return 1;
+        }
+    }
+
+    DBENCH_STOP(*tsample);
+    return 0;
+}
+
+/*************************************************
+* Name:        rej_uniform
+*
+* Description: Sample uniformly random coefficients in [0, Q-1] by
+*              performing rejection sampling on array of random bytes.
+*
+* Arguments:   - int32_t *a: pointer to output array (allocated)
+*              - unsigned int len: number of coefficients to be sampled
+*              - const uint8_t *buf: array of random bytes
+*              - unsigned int buflen: length of array of random bytes
+*
+* Returns number of sampled coefficients. Can be smaller than len if not enough
+* random bytes were given.
+**************************************************/
+static unsigned int rej_uniform(int32_t *a,
+                                unsigned int len,
+                                const uint8_t *buf,
+                                unsigned int buflen) {
+    unsigned int ctr, pos;
+    uint32_t t;
+    DBENCH_START();
+
+    ctr = pos = 0;
+    while (ctr < len && pos + 3 <= buflen) {
+        t  = buf[pos++];
+        t |= (uint32_t)buf[pos++] << 8;
+        t |= (uint32_t)buf[pos++] << 16;
+        t &= 0x7FFFFF;
+
+        if (t < DILITHIUM_Q) {
+            a[ctr++] = t;
+        }
+    }
+
+    DBENCH_STOP(*tsample);
+    return ctr;
+}
+
+/*************************************************
+* Name:        poly_uniform
+*
+* Description: Sample polynomial with uniformly random coefficients
+*              in [0,Q-1] by performing rejection sampling on the
+*              output stream of SHAKE256(seed|nonce) or AES256CTR(seed,nonce).
+*
+* Arguments:   - poly *a: pointer to output polynomial
+*              - const uint8_t seed[]: byte array with seed of length SEEDBYTES
+*              - uint16_t nonce: 2-byte nonce
+**************************************************/
+
+#define POLY_UNIFORM_NBLOCKS ((768 + STREAM128_BLOCKBYTES - 1)/STREAM128_BLOCKBYTES)
+void poly_uniform(poly *a,
+                  const uint8_t seed[SEEDBYTES],
+                  uint16_t nonce) {
+    unsigned int i, ctr, off;
+    unsigned int buflen = POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES;
+    uint8_t buf[POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES + 2];
+    stream128_state state;
+
+    stream128_init(&state, seed, nonce);
+    stream128_squeezeblocks(buf, POLY_UNIFORM_NBLOCKS, &state);
+
+    ctr = rej_uniform(a->coeffs, N, buf, buflen);
+
+    while (ctr < N) {
+        off = buflen % 3;
+        for (i = 0; i < off; ++i) {
+            buf[i] = buf[buflen - off + i];
+        }
+
+        stream128_squeezeblocks(buf + off, 1, &state);
+        buflen = STREAM128_BLOCKBYTES + off;
+        ctr += rej_uniform(a->coeffs + ctr, N - ctr, buf, buflen);
+    }
+    stream128_release(&state);
+}
+
+void poly_uniformx2(poly *a0, poly *a1,
+                    const uint8_t seed[SEEDBYTES],
+                    uint16_t nonce0, uint16_t nonce1) {
+    unsigned int ctr0, ctr1;
+    unsigned int buflen = POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES;
+    uint8_t buf0[POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES + 2];
+    uint8_t buf1[POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES + 2];
+
+    keccakx2_state statex2;
+    dilithium_shake128x2_stream_init(&statex2, seed, nonce0, nonce1);
+    shake128x2_squeezeblocks(buf0, buf1, POLY_UNIFORM_NBLOCKS, &statex2);
+
+    ctr0 = rej_uniform(a0->coeffs, N, buf0, buflen);
+    ctr1 = rej_uniform(a1->coeffs, N, buf1, buflen);
+
+    while (ctr0 < N || ctr1 < N) {
+        shake128x2_squeezeblocks(buf0, buf1, 1, &statex2);
+        ctr0 += rej_uniform(a0->coeffs + ctr0, N - ctr0, buf0, buflen);
+        ctr1 += rej_uniform(a1->coeffs + ctr1, N - ctr1, buf1, buflen);
+    }
+
+
+}
+
+/*************************************************
+* Name:        rej_eta
+*
+* Description: Sample uniformly random coefficients in [-ETA, ETA] by
+*              performing rejection sampling on array of random bytes.
+*
+* Arguments:   - int32_t *a: pointer to output array (allocated)
+*              - unsigned int len: number of coefficients to be sampled
+*              - const uint8_t *buf: array of random bytes
+*              - unsigned int buflen: length of array of random bytes
+*
+* Returns number of sampled coefficients. Can be smaller than len if not enough
+* random bytes were given.
+**************************************************/
+static unsigned int rej_eta(int32_t *a,
+                            unsigned int len,
+                            const uint8_t *buf,
+                            unsigned int buflen) {
+    unsigned int ctr, pos;
+    uint32_t t0, t1;
+    DBENCH_START();
+
+    ctr = pos = 0;
+    while (ctr < len && pos < buflen) {
+        t0 = buf[pos] & 0x0F;
+        t1 = buf[pos++] >> 4;
+
+
+        if (t0 < 15) {
+            t0 = t0 - (205 * t0 >> 10) * 5;
+            a[ctr++] = 2 - t0;
+        }
+        if (t1 < 15 && ctr < len) {
+            t1 = t1 - (205 * t1 >> 10) * 5;
+            a[ctr++] = 2 - t1;
+        }
+
+
+
+    }
+
+    DBENCH_STOP(*tsample);
+    return ctr;
+}
+
+/*************************************************
+* Name:        poly_uniform_eta
+*
+* Description: Sample polynomial with uniformly random coefficients
+*              in [-ETA,ETA] by performing rejection sampling on the
+*              output stream from SHAKE256(seed|nonce) or AES256CTR(seed,nonce).
+*
+* Arguments:   - poly *a: pointer to output polynomial
+*              - const uint8_t seed[]: byte array with seed of length CRHBYTES
+*              - uint16_t nonce: 2-byte nonce
+**************************************************/
+#define POLY_UNIFORM_ETA_NBLOCKS ((136 + STREAM256_BLOCKBYTES - 1)/STREAM256_BLOCKBYTES)
+void poly_uniform_eta(poly *a,
+                      const uint8_t seed[CRHBYTES],
+                      uint16_t nonce) {
+    unsigned int ctr;
+    unsigned int buflen = POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES;
+    uint8_t buf[POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES];
+    stream256_state state;
+
+    stream256_init(&state, seed, nonce);
+    stream256_squeezeblocks(buf, POLY_UNIFORM_ETA_NBLOCKS, &state);
+
+    ctr = rej_eta(a->coeffs, N, buf, buflen);
+
+    while (ctr < N) {
+        stream256_squeezeblocks(buf, 1, &state);
+        ctr += rej_eta(a->coeffs + ctr, N - ctr, buf, STREAM256_BLOCKBYTES);
+    }
+    stream256_release(&state);
+}
+
+void poly_uniform_etax2(poly *a0, poly *a1,
+                        const uint8_t seed[CRHBYTES],
+                        uint16_t nonce0, uint16_t nonce1) {
+    unsigned int ctr0, ctr1;
+    unsigned int buflen = POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES;
+
+    uint8_t buf0[POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES];
+    uint8_t buf1[POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES];
+
+    keccakx2_state statex2;
+
+    dilithium_shake256x2_stream_init(&statex2, seed, nonce0, nonce1);
+    shake256x2_squeezeblocks(buf0, buf1, POLY_UNIFORM_ETA_NBLOCKS, &statex2);
+
+    ctr0 = rej_eta(a0->coeffs, N, buf0, buflen);
+    ctr1 = rej_eta(a1->coeffs, N, buf1, buflen);
+
+    while (ctr0 < N || ctr1 < N) {
+        shake256x2_squeezeblocks(buf0, buf1, 1, &statex2);
+        ctr0 += rej_eta(a0->coeffs + ctr0, N - ctr0, buf0, STREAM256_BLOCKBYTES);
+        ctr1 += rej_eta(a1->coeffs + ctr1, N - ctr1, buf1, STREAM256_BLOCKBYTES);
+    }
+}
+
+/*************************************************
+* Name:        poly_uniform_gamma1m1
+*
+* Description: Sample polynomial with uniformly random coefficients
+*              in [-(GAMMA1 - 1), GAMMA1] by unpacking output stream
+*              of SHAKE256(seed|nonce) or AES256CTR(seed,nonce).
+*
+* Arguments:   - poly *a: pointer to output polynomial
+*              - const uint8_t seed[]: byte array with seed of length CRHBYTES
+*              - uint16_t nonce: 16-bit nonce
+**************************************************/
+#define POLY_UNIFORM_GAMMA1_NBLOCKS ((POLYZ_PACKEDBYTES + STREAM256_BLOCKBYTES - 1)/STREAM256_BLOCKBYTES)
+void poly_uniform_gamma1(poly *a,
+                         const uint8_t seed[CRHBYTES],
+                         uint16_t nonce) {
+    uint8_t buf[POLY_UNIFORM_GAMMA1_NBLOCKS * STREAM256_BLOCKBYTES];
+    stream256_state state;
+
+    stream256_init(&state, seed, nonce);
+    stream256_squeezeblocks(buf, POLY_UNIFORM_GAMMA1_NBLOCKS, &state);
+    stream256_release(&state);
+    polyz_unpack(a, buf);
+}
+
+void poly_uniform_gamma1x2(poly *a0, poly *a1,
+                           const uint8_t seed[CRHBYTES],
+                           uint16_t nonce0, uint16_t nonce1) {
+
+    uint8_t buf0[POLY_UNIFORM_GAMMA1_NBLOCKS * STREAM256_BLOCKBYTES];
+    uint8_t buf1[POLY_UNIFORM_GAMMA1_NBLOCKS * STREAM256_BLOCKBYTES];
+
+    keccakx2_state statex2;
+
+    dilithium_shake256x2_stream_init(&statex2, seed, nonce0, nonce1);
+    shake256x2_squeezeblocks(buf0, buf1, POLY_UNIFORM_GAMMA1_NBLOCKS, &statex2);
+
+    polyz_unpack(a0, buf0);
+    polyz_unpack(a1, buf1);
+
+}
+
+/*************************************************
+* Name:        challenge
+*
+* Description: Implementation of H. Samples polynomial with TAU nonzero
+*              coefficients in {-1,1} using the output stream of
+*              SHAKE256(seed).
+*
+* Arguments:   - poly *c: pointer to output polynomial
+*              - const uint8_t mu[]: byte array containing seed of length SEEDBYTES
+**************************************************/
+void poly_challenge(poly *c, const uint8_t seed[SEEDBYTES]) {
+    unsigned int i, b, pos;
+    uint64_t signs;
+    uint8_t buf[SHAKE256_RATE];
+    shake256incctx state;
+
+    shake256_inc_init(&state);
+    shake256_inc_absorb(&state, seed, SEEDBYTES);
+    shake256_inc_finalize(&state);
+    shake256_inc_squeeze(buf, sizeof buf, &state);
+
+    signs = 0;
+    for (i = 0; i < 8; ++i) {
+        signs |= (uint64_t)buf[i] << 8 * i;
+    }
+    pos = 8;
+
+    for (i = 0; i < N; ++i) {
+        c->coeffs[i] = 0;
+    }
+    for (i = N - TAU; i < N; ++i) {
+        do {
+            if (pos >= SHAKE256_RATE) {
+                shake256_inc_squeeze(buf, sizeof buf, &state);
+                pos = 0;
+            }
+
+            b = buf[pos++];
+        } while (b > i);
+
+        c->coeffs[i] = c->coeffs[b];
+        c->coeffs[b] = 1 - 2 * (signs & 1);
+        signs >>= 1;
+    }
+    shake256_inc_ctx_release(&state);
+}
+
+/*************************************************
+* Name:        polyeta_pack
+*
+* Description: Bit-pack polynomial with coefficients in [-ETA,ETA].
+*
+* Arguments:   - uint8_t *r: pointer to output byte array with at least
+*                            POLYETA_PACKEDBYTES bytes
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+void polyeta_pack(uint8_t *r, const poly *a) {
+    unsigned int i;
+    uint8_t t[8];
+    DBENCH_START();
+
+
+    for (i = 0; i < N / 8; ++i) {
+        t[0] = ETA - a->coeffs[8 * i + 0];
+        t[1] = ETA - a->coeffs[8 * i + 1];
+        t[2] = ETA - a->coeffs[8 * i + 2];
+        t[3] = ETA - a->coeffs[8 * i + 3];
+        t[4] = ETA - a->coeffs[8 * i + 4];
+        t[5] = ETA - a->coeffs[8 * i + 5];
+        t[6] = ETA - a->coeffs[8 * i + 6];
+        t[7] = ETA - a->coeffs[8 * i + 7];
+
+        r[3 * i + 0]  = (t[0] >> 0) | (t[1] << 3) | (t[2] << 6);
+        r[3 * i + 1]  = (t[2] >> 2) | (t[3] << 1) | (t[4] << 4) | (t[5] << 7);
+        r[3 * i + 2]  = (t[5] >> 1) | (t[6] << 2) | (t[7] << 5);
+    }
+
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyeta_unpack
+*
+* Description: Unpack polynomial with coefficients in [-ETA,ETA].
+*
+* Arguments:   - poly *r: pointer to output polynomial
+*              - const uint8_t *a: byte array with bit-packed polynomial
+**************************************************/
+void polyeta_unpack(poly *r, const uint8_t *a) {
+    unsigned int i;
+    DBENCH_START();
+
+
+    for (i = 0; i < N / 8; ++i) {
+        r->coeffs[8 * i + 0] =  (a[3 * i + 0] >> 0) & 7;
+        r->coeffs[8 * i + 1] =  (a[3 * i + 0] >> 3) & 7;
+        r->coeffs[8 * i + 2] = ((a[3 * i + 0] >> 6) | (a[3 * i + 1] << 2)) & 7;
+        r->coeffs[8 * i + 3] =  (a[3 * i + 1] >> 1) & 7;
+        r->coeffs[8 * i + 4] =  (a[3 * i + 1] >> 4) & 7;
+        r->coeffs[8 * i + 5] = ((a[3 * i + 1] >> 7) | (a[3 * i + 2] << 1)) & 7;
+        r->coeffs[8 * i + 6] =  (a[3 * i + 2] >> 2) & 7;
+        r->coeffs[8 * i + 7] =  (a[3 * i + 2] >> 5) & 7;
+
+        r->coeffs[8 * i + 0] = ETA - r->coeffs[8 * i + 0];
+        r->coeffs[8 * i + 1] = ETA - r->coeffs[8 * i + 1];
+        r->coeffs[8 * i + 2] = ETA - r->coeffs[8 * i + 2];
+        r->coeffs[8 * i + 3] = ETA - r->coeffs[8 * i + 3];
+        r->coeffs[8 * i + 4] = ETA - r->coeffs[8 * i + 4];
+        r->coeffs[8 * i + 5] = ETA - r->coeffs[8 * i + 5];
+        r->coeffs[8 * i + 6] = ETA - r->coeffs[8 * i + 6];
+        r->coeffs[8 * i + 7] = ETA - r->coeffs[8 * i + 7];
+    }
+
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyt1_pack
+*
+* Description: Bit-pack polynomial t1 with coefficients fitting in 10 bits.
+*              Input coefficients are assumed to be standard representatives.
+*
+* Arguments:   - uint8_t *r: pointer to output byte array with at least
+*                            POLYT1_PACKEDBYTES bytes
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+void polyt1_pack(uint8_t *r, const poly *a) {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N / 4; ++i) {
+        r[5 * i + 0] = (uint8_t) (a->coeffs[4 * i + 0] >> 0);
+        r[5 * i + 1] = (uint8_t) ((a->coeffs[4 * i + 0] >> 8) | (a->coeffs[4 * i + 1] << 2));
+        r[5 * i + 2] = (uint8_t) ((a->coeffs[4 * i + 1] >> 6) | (a->coeffs[4 * i + 2] << 4));
+        r[5 * i + 3] = (uint8_t) ((a->coeffs[4 * i + 2] >> 4) | (a->coeffs[4 * i + 3] << 6));
+        r[5 * i + 4] = (uint8_t) (a->coeffs[4 * i + 3] >> 2);
+    }
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyt1_unpack
+*
+* Description: Unpack polynomial t1 with 10-bit coefficients.
+*              Output coefficients are standard representatives.
+*
+* Arguments:   - poly *r: pointer to output polynomial
+*              - const uint8_t *a: byte array with bit-packed polynomial
+**************************************************/
+extern void PQCLEAN_DILITHIUM2_AARCH64_asm_10_to_32(int32_t *, const uint8_t *);
+void polyt1_unpack(poly *r, const uint8_t *a) {
+    DBENCH_START();
+
+    PQCLEAN_DILITHIUM2_AARCH64_asm_10_to_32(r->coeffs, a);
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyt0_pack
+*
+* Description: Bit-pack polynomial t0 with coefficients in ]-2^{D-1}, 2^{D-1}].
+*
+* Arguments:   - uint8_t *r: pointer to output byte array with at least
+*                            POLYT0_PACKEDBYTES bytes
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+void polyt0_pack(uint8_t *r, const poly *a) {
+    unsigned int i;
+    uint32_t t[8];
+    DBENCH_START();
+
+    for (i = 0; i < N / 8; ++i) {
+        t[0] = (1 << (D - 1)) - a->coeffs[8 * i + 0];
+        t[1] = (1 << (D - 1)) - a->coeffs[8 * i + 1];
+        t[2] = (1 << (D - 1)) - a->coeffs[8 * i + 2];
+        t[3] = (1 << (D - 1)) - a->coeffs[8 * i + 3];
+        t[4] = (1 << (D - 1)) - a->coeffs[8 * i + 4];
+        t[5] = (1 << (D - 1)) - a->coeffs[8 * i + 5];
+        t[6] = (1 << (D - 1)) - a->coeffs[8 * i + 6];
+        t[7] = (1 << (D - 1)) - a->coeffs[8 * i + 7];
+
+        r[13 * i + 0]  =  (uint8_t) t[0];
+        r[13 * i + 1]  =  (uint8_t) (t[0] >>  8);
+        r[13 * i + 1] |=  (uint8_t) (t[1] <<  5);
+        r[13 * i + 2]  =  (uint8_t) (t[1] >>  3);
+        r[13 * i + 3]  =  (uint8_t) (t[1] >> 11);
+        r[13 * i + 3] |=  (uint8_t) (t[2] <<  2);
+        r[13 * i + 4]  =  (uint8_t) (t[2] >>  6);
+        r[13 * i + 4] |=  (uint8_t) (t[3] <<  7);
+        r[13 * i + 5]  =  (uint8_t) (t[3] >>  1);
+        r[13 * i + 6]  =  (uint8_t) (t[3] >>  9);
+        r[13 * i + 6] |=  (uint8_t) (t[4] <<  4);
+        r[13 * i + 7]  =  (uint8_t) (t[4] >>  4);
+        r[13 * i + 8]  =  (uint8_t) (t[4] >> 12);
+        r[13 * i + 8] |=  (uint8_t) (t[5] <<  1);
+        r[13 * i + 9]  =  (uint8_t) (t[5] >>  7);
+        r[13 * i + 9] |=  (uint8_t) (t[6] <<  6);
+        r[13 * i + 10]  =  (uint8_t) (t[6] >>  2);
+        r[13 * i + 11]  =  (uint8_t) (t[6] >> 10);
+        r[13 * i + 11] |=  (uint8_t) (t[7] <<  3);
+        r[13 * i + 12]  =  (uint8_t) (t[7] >>  5);
+    }
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyt0_unpack
+*
+* Description: Unpack polynomial t0 with coefficients in ]-2^{D-1}, 2^{D-1}].
+*
+* Arguments:   - poly *r: pointer to output polynomial
+*              - const uint8_t *a: byte array with bit-packed polynomial
+**************************************************/
+void polyt0_unpack(poly *r, const uint8_t *a) {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N / 8; ++i) {
+        r->coeffs[8 * i + 0]  = a[13 * i + 0];
+        r->coeffs[8 * i + 0] |= (uint32_t)a[13 * i + 1] << 8;
+        r->coeffs[8 * i + 0] &= 0x1FFF;
+
+        r->coeffs[8 * i + 1]  = a[13 * i + 1] >> 5;
+        r->coeffs[8 * i + 1] |= (uint32_t)a[13 * i + 2] << 3;
+        r->coeffs[8 * i + 1] |= (uint32_t)a[13 * i + 3] << 11;
+        r->coeffs[8 * i + 1] &= 0x1FFF;
+
+        r->coeffs[8 * i + 2]  = a[13 * i + 3] >> 2;
+        r->coeffs[8 * i + 2] |= (uint32_t)a[13 * i + 4] << 6;
+        r->coeffs[8 * i + 2] &= 0x1FFF;
+
+        r->coeffs[8 * i + 3]  = a[13 * i + 4] >> 7;
+        r->coeffs[8 * i + 3] |= (uint32_t)a[13 * i + 5] << 1;
+        r->coeffs[8 * i + 3] |= (uint32_t)a[13 * i + 6] << 9;
+        r->coeffs[8 * i + 3] &= 0x1FFF;
+
+        r->coeffs[8 * i + 4]  = a[13 * i + 6] >> 4;
+        r->coeffs[8 * i + 4] |= (uint32_t)a[13 * i + 7] << 4;
+        r->coeffs[8 * i + 4] |= (uint32_t)a[13 * i + 8] << 12;
+        r->coeffs[8 * i + 4] &= 0x1FFF;
+
+        r->coeffs[8 * i + 5]  = a[13 * i + 8] >> 1;
+        r->coeffs[8 * i + 5] |= (uint32_t)a[13 * i + 9] << 7;
+        r->coeffs[8 * i + 5] &= 0x1FFF;
+
+        r->coeffs[8 * i + 6]  = a[13 * i + 9] >> 6;
+        r->coeffs[8 * i + 6] |= (uint32_t)a[13 * i + 10] << 2;
+        r->coeffs[8 * i + 6] |= (uint32_t)a[13 * i + 11] << 10;
+        r->coeffs[8 * i + 6] &= 0x1FFF;
+
+        r->coeffs[8 * i + 7]  = a[13 * i + 11] >> 3;
+        r->coeffs[8 * i + 7] |= (uint32_t)a[13 * i + 12] << 5;
+        r->coeffs[8 * i + 7] &= 0x1FFF;
+
+        r->coeffs[8 * i + 0] = (1 << (D - 1)) - r->coeffs[8 * i + 0];
+        r->coeffs[8 * i + 1] = (1 << (D - 1)) - r->coeffs[8 * i + 1];
+        r->coeffs[8 * i + 2] = (1 << (D - 1)) - r->coeffs[8 * i + 2];
+        r->coeffs[8 * i + 3] = (1 << (D - 1)) - r->coeffs[8 * i + 3];
+        r->coeffs[8 * i + 4] = (1 << (D - 1)) - r->coeffs[8 * i + 4];
+        r->coeffs[8 * i + 5] = (1 << (D - 1)) - r->coeffs[8 * i + 5];
+        r->coeffs[8 * i + 6] = (1 << (D - 1)) - r->coeffs[8 * i + 6];
+        r->coeffs[8 * i + 7] = (1 << (D - 1)) - r->coeffs[8 * i + 7];
+    }
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyz_pack
+*
+* Description: Bit-pack polynomial with coefficients
+*              in [-(GAMMA1 - 1), GAMMA1].
+*
+* Arguments:   - uint8_t *r: pointer to output byte array with at least
+*                            POLYZ_PACKEDBYTES bytes
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+void polyz_pack(uint8_t *r, const poly *a) {
+    unsigned int i;
+    uint32_t t[4];
+    DBENCH_START();
+
+
+    for (i = 0; i < N / 4; ++i) {
+        t[0] = GAMMA1 - a->coeffs[4 * i + 0];
+        t[1] = GAMMA1 - a->coeffs[4 * i + 1];
+        t[2] = GAMMA1 - a->coeffs[4 * i + 2];
+        t[3] = GAMMA1 - a->coeffs[4 * i + 3];
+
+        r[9 * i + 0]  = t[0];
+        r[9 * i + 1]  = t[0] >> 8;
+        r[9 * i + 2]  = t[0] >> 16;
+        r[9 * i + 2] |= t[1] << 2;
+        r[9 * i + 3]  = t[1] >> 6;
+        r[9 * i + 4]  = t[1] >> 14;
+        r[9 * i + 4] |= t[2] << 4;
+        r[9 * i + 5]  = t[2] >> 4;
+        r[9 * i + 6]  = t[2] >> 12;
+        r[9 * i + 6] |= t[3] << 6;
+        r[9 * i + 7]  = t[3] >> 2;
+        r[9 * i + 8]  = t[3] >> 10;
+    }
+
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyz_unpack
+*
+* Description: Unpack polynomial z with coefficients
+*              in [-(GAMMA1 - 1), GAMMA1].
+*
+* Arguments:   - poly *r: pointer to output polynomial
+*              - const uint8_t *a: byte array with bit-packed polynomial
+**************************************************/
+void polyz_unpack(poly *r, const uint8_t *a) {
+    unsigned int i;
+    DBENCH_START();
+
+
+    for (i = 0; i < N / 4; ++i) {
+        r->coeffs[4 * i + 0]  = a[9 * i + 0];
+        r->coeffs[4 * i + 0] |= (uint32_t)a[9 * i + 1] << 8;
+        r->coeffs[4 * i + 0] |= (uint32_t)a[9 * i + 2] << 16;
+        r->coeffs[4 * i + 0] &= 0x3FFFF;
+
+        r->coeffs[4 * i + 1]  = a[9 * i + 2] >> 2;
+        r->coeffs[4 * i + 1] |= (uint32_t)a[9 * i + 3] << 6;
+        r->coeffs[4 * i + 1] |= (uint32_t)a[9 * i + 4] << 14;
+        r->coeffs[4 * i + 1] &= 0x3FFFF;
+
+        r->coeffs[4 * i + 2]  = a[9 * i + 4] >> 4;
+        r->coeffs[4 * i + 2] |= (uint32_t)a[9 * i + 5] << 4;
+        r->coeffs[4 * i + 2] |= (uint32_t)a[9 * i + 6] << 12;
+        r->coeffs[4 * i + 2] &= 0x3FFFF;
+
+        r->coeffs[4 * i + 3]  = a[9 * i + 6] >> 6;
+        r->coeffs[4 * i + 3] |= (uint32_t)a[9 * i + 7] << 2;
+        r->coeffs[4 * i + 3] |= (uint32_t)a[9 * i + 8] << 10;
+        r->coeffs[4 * i + 3] &= 0x3FFFF;
+
+        r->coeffs[4 * i + 0] = GAMMA1 - r->coeffs[4 * i + 0];
+        r->coeffs[4 * i + 1] = GAMMA1 - r->coeffs[4 * i + 1];
+        r->coeffs[4 * i + 2] = GAMMA1 - r->coeffs[4 * i + 2];
+        r->coeffs[4 * i + 3] = GAMMA1 - r->coeffs[4 * i + 3];
+    }
+
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyw1_pack
+*
+* Description: Bit-pack polynomial w1 with coefficients in [0,15] or [0,43].
+*              Input coefficients are assumed to be standard representatives.
+*
+* Arguments:   - uint8_t *r: pointer to output byte array with at least
+*                            POLYW1_PACKEDBYTES bytes
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+void polyw1_pack(uint8_t *r, const poly *a) {
+    unsigned int i;
+    DBENCH_START();
+
+
+    for (i = 0; i < N / 4; ++i) {
+        r[3 * i + 0]  = a->coeffs[4 * i + 0];
+        r[3 * i + 0] |= a->coeffs[4 * i + 1] << 6;
+        r[3 * i + 1]  = a->coeffs[4 * i + 1] >> 2;
+        r[3 * i + 1] |= a->coeffs[4 * i + 2] << 4;
+        r[3 * i + 2]  = a->coeffs[4 * i + 2] >> 4;
+        r[3 * i + 2] |= a->coeffs[4 * i + 3] << 2;
+    }
+
+
+    DBENCH_STOP(*tpack);
+}

src/sign/dilithium/dilithium2/aarch64/poly.h

@@ -0,0 +1,92 @@
+#ifndef POLY_H
+#define POLY_H
+#include "params.h"
+#include <stdint.h>
+
+typedef struct {
+    int32_t coeffs[N];
+} poly;
+
+#define poly_reduce DILITHIUM_NAMESPACE(poly_reduce)
+void poly_reduce(poly *a);
+#define poly_caddq DILITHIUM_NAMESPACE(poly_caddq)
+void poly_caddq(poly *a);
+#define poly_freeze DILITHIUM_NAMESPACE(poly_freeze)
+void poly_freeze(poly *a);
+
+#define poly_add DILITHIUM_NAMESPACE(poly_add)
+void poly_add(poly *c, const poly *a, const poly *b);
+#define poly_sub DILITHIUM_NAMESPACE(poly_sub)
+void poly_sub(poly *c, const poly *a, const poly *b);
+#define poly_shiftl DILITHIUM_NAMESPACE(poly_shiftl)
+void poly_shiftl(poly *a);
+
+#define poly_ntt DILITHIUM_NAMESPACE(poly_ntt)
+void poly_ntt(poly *a);
+#define poly_invntt_tomont DILITHIUM_NAMESPACE(poly_invntt_tomont)
+void poly_invntt_tomont(poly *a);
+#define poly_pointwise_montgomery DILITHIUM_NAMESPACE(poly_pointwise_montgomery)
+void poly_pointwise_montgomery(poly *c, const poly *a, const poly *b);
+
+#define poly_power2round DILITHIUM_NAMESPACE(poly_power2round)
+void poly_power2round(poly *a1, poly *a0, const poly *a);
+#define poly_decompose DILITHIUM_NAMESPACE(poly_decompose)
+void poly_decompose(poly *a1, poly *a0, const poly *a);
+#define poly_make_hint DILITHIUM_NAMESPACE(poly_make_hint)
+unsigned int poly_make_hint(poly *h, const poly *a0, const poly *a1);
+#define poly_use_hint DILITHIUM_NAMESPACE(poly_use_hint)
+void poly_use_hint(poly *b, const poly *a, const poly *h);
+
+#define poly_chknorm DILITHIUM_NAMESPACE(poly_chknorm)
+int poly_chknorm(const poly *a, int32_t B);
+#define poly_uniform DILITHIUM_NAMESPACE(poly_uniform)
+void poly_uniform(poly *a,
+                  const uint8_t seed[SEEDBYTES],
+                  uint16_t nonce);
+#define poly_uniformx2 DILITHIUM_NAMESPACE(poly_uniformx2)
+void poly_uniformx2(poly *a0, poly *a1,
+                    const uint8_t seed[SEEDBYTES],
+                    uint16_t nonce0, uint16_t nonce1);
+#define poly_uniform_eta DILITHIUM_NAMESPACE(poly_uniform_eta)
+void poly_uniform_eta(poly *a,
+                      const uint8_t seed[CRHBYTES],
+                      uint16_t nonce);
+#define poly_uniform_etax2 DILITHIUM_NAMESPACE(poly_uniform_etax2)
+void poly_uniform_etax2(poly *a0, poly *a1,
+                        const uint8_t seed[CRHBYTES],
+                        uint16_t nonce0, uint16_t nonce1);
+#define poly_uniform_gamma1 DILITHIUM_NAMESPACE(poly_uniform_gamma1)
+void poly_uniform_gamma1(poly *a,
+                         const uint8_t seed[CRHBYTES],
+                         uint16_t nonce);
+#define poly_uniform_gamma1x2 DILITHIUM_NAMESPACE(poly_uniform_gamma1x2)
+void poly_uniform_gamma1x2(poly *a0, poly *a1,
+                           const uint8_t seed[CRHBYTES],
+                           uint16_t nonce0, uint16_t nonce1);
+#define poly_challenge DILITHIUM_NAMESPACE(poly_challenge)
+void poly_challenge(poly *c, const uint8_t seed[SEEDBYTES]);
+
+#define polyeta_pack DILITHIUM_NAMESPACE(polyeta_pack)
+void polyeta_pack(uint8_t *r, const poly *a);
+#define polyeta_unpack DILITHIUM_NAMESPACE(polyeta_unpack)
+void polyeta_unpack(poly *r, const uint8_t *a);
+
+#define polyt1_pack DILITHIUM_NAMESPACE(polyt1_pack)
+void polyt1_pack(uint8_t *r, const poly *a);
+#define polyt1_unpack DILITHIUM_NAMESPACE(polyt1_unpack)
+void polyt1_unpack(poly *r, const uint8_t *a);
+
+#define polyt0_pack DILITHIUM_NAMESPACE(polyt0_pack)
+void polyt0_pack(uint8_t *r, const poly *a);
+#define polyt0_unpack DILITHIUM_NAMESPACE(polyt0_unpack)
+void polyt0_unpack(poly *r, const uint8_t *a);
+
+#define polyz_pack DILITHIUM_NAMESPACE(polyz_pack)
+void polyz_pack(uint8_t *r, const poly *a);
+#define polyz_unpack DILITHIUM_NAMESPACE(polyz_unpack)
+void polyz_unpack(poly *r, const uint8_t *a);
+
+#define polyw1_pack DILITHIUM_NAMESPACE(polyw1_pack)
+void polyw1_pack(uint8_t *r, const poly *a);
+
+#endif

src/sign/dilithium/dilithium2/aarch64/polyvec.c

@@ -0,0 +1,452 @@
+#include "params.h"
+#include "poly.h"
+#include "polyvec.h"
+#include <stdint.h>
+
+#include "reduce.h"
+
+static const int32_t l_montgomery_const[4] = {
+    DILITHIUM_Q, DILITHIUM_QINV
+};
+
+/*************************************************
+* Name:        expand_mat
+*
+* Description: Implementation of ExpandA. Generates matrix A with uniformly
+*              random coefficients a_{i,j} by performing rejection
+*              sampling on the output stream of SHAKE128(rho|j|i)
+*              or AES256CTR(rho,j|i).
+*
+* Arguments:   - polyvecl mat[K]: output matrix
+*              - const uint8_t rho[]: byte array containing seed rho
+**************************************************/
+void polyvec_matrix_expand(polyvecl mat[K], const uint8_t rho[SEEDBYTES]) {
+    unsigned int i, j;
+
+    for (j = 0; j < L; ++j) {
+        for (i = 0; i < K; i += 2) {
+            poly_uniformx2(&mat[i + 0].vec[j], &mat[i + 1].vec[j], rho, (uint16_t) ((i << 8) + j), (uint16_t) (((i + 1) << 8) + j));
+        }
+    }
+}
+
+void polyvec_matrix_pointwise_montgomery(polyveck *t, const polyvecl mat[K], const polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        polyvecl_pointwise_acc_montgomery(&t->vec[i], &mat[i], v);
+    }
+}
+
+/**************************************************************/
+/************ Vectors of polynomials of length L **************/
+/**************************************************************/
+
+void polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_uniform_eta(&v->vec[i], seed, nonce++);
+    }
+}
+
+void polyvecl_uniform_gamma1(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
+    unsigned int i;
+
+    for (i = 0; i < L - 1; i += 2) {
+        poly_uniform_gamma1x2(&v->vec[i + 0], &v->vec[i + 1], seed, (uint16_t) (L * nonce + i + 0), (uint16_t) (L * nonce + i + 1));
+    }
+    if (L & 1) {
+        poly_uniform_gamma1(&v->vec[i], seed, (uint16_t) (L * nonce + L - 1));
+    }
+}
+
+void polyvecl_reduce(polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_reduce(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyvecl_freeze
+*
+* Description: Reduce coefficients of polynomials in vector of length L
+*              to standard representatives.
+*
+* Arguments:   - polyvecl *v: pointer to input/output vector
+**************************************************/
+void polyvecl_freeze(polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_freeze(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyvecl_add
+*
+* Description: Add vectors of polynomials of length L.
+*              No modular reduction is performed.
+*
+* Arguments:   - polyvecl *w: pointer to output vector
+*              - const polyvecl *u: pointer to first summand
+*              - const polyvecl *v: pointer to second summand
+**************************************************/
+void polyvecl_add(polyvecl *w, const polyvecl *u, const polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_add(&w->vec[i], &u->vec[i], &v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyvecl_ntt
+*
+* Description: Forward NTT of all polynomials in vector of length L. Output
+*              coefficients can be up to 16*Q larger than input coefficients.
+*
+* Arguments:   - polyvecl *v: pointer to input/output vector
+**************************************************/
+void polyvecl_ntt(polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_ntt(&v->vec[i]);
+    }
+}
+
+void polyvecl_invntt_tomont(polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_invntt_tomont(&v->vec[i]);
+    }
+}
+
+void polyvecl_pointwise_poly_montgomery(polyvecl *r, const poly *a, const polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_pointwise_montgomery(&r->vec[i], a, &v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyvecl_pointwise_acc_montgomery
+*
+* Description: Pointwise multiply vectors of polynomials of length L, multiply
+*              resulting vector by 2^{-32} and add (accumulate) polynomials
+*              in it. Input/output vectors are in NTT domain representation.
+*
+* Arguments:   - poly *w: output polynomial
+*              - const polyvecl *u: pointer to first input vector
+*              - const polyvecl *v: pointer to second input vector
+**************************************************/
+extern void PQCLEAN_DILITHIUM2_AARCH64_asm_polyvecl_pointwise_acc_montgomery(int32_t *, const int32_t *, const int32_t *, const int32_t *);
+void polyvecl_pointwise_acc_montgomery(poly *w,
+                                       const polyvecl *u,
+                                       const polyvecl *v) {
+    PQCLEAN_DILITHIUM2_AARCH64_asm_polyvecl_pointwise_acc_montgomery(w->coeffs, u->vec[0].coeffs, v->vec[0].coeffs, l_montgomery_const);
+}
+
+/*************************************************
+* Name:        polyvecl_chknorm
+*
+* Description: Check infinity norm of polynomials in vector of length L.
+*              Assumes input polyvecl to be reduced by polyvecl_reduce().
+*
+* Arguments:   - const polyvecl *v: pointer to vector
+*              - int32_t B: norm bound
+*
+* Returns 0 if norm of all polynomials is strictly smaller than B <= (Q-1)/8
+* and 1 otherwise.
+**************************************************/
+int polyvecl_chknorm(const polyvecl *v, int32_t bound)  {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        if (poly_chknorm(&v->vec[i], bound)) {
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
+/**************************************************************/
+/************ Vectors of polynomials of length K **************/
+/**************************************************************/
+
+void polyveck_uniform_eta(polyveck *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_uniform_eta(&v->vec[i], seed, nonce++);
+    }
+
+}
+
+/*************************************************
+* Name:        polyveck_reduce
+*
+* Description: Reduce coefficients of polynomials in vector of length K
+*              to representatives in [-6283009,6283007].
+*
+* Arguments:   - polyveck *v: pointer to input/output vector
+**************************************************/
+void polyveck_reduce(polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_reduce(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_caddq
+*
+* Description: For all coefficients of polynomials in vector of length K
+*              add Q if coefficient is negative.
+*
+* Arguments:   - polyveck *v: pointer to input/output vector
+**************************************************/
+void polyveck_caddq(polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_caddq(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_freeze
+*
+* Description: Reduce coefficients of polynomials in vector of length K
+*              to standard representatives.
+*
+* Arguments:   - polyveck *v: pointer to input/output vector
+**************************************************/
+void polyveck_freeze(polyveck *v)  {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_freeze(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_add
+*
+* Description: Add vectors of polynomials of length K.
+*              No modular reduction is performed.
+*
+* Arguments:   - polyveck *w: pointer to output vector
+*              - const polyveck *u: pointer to first summand
+*              - const polyveck *v: pointer to second summand
+**************************************************/
+void polyveck_add(polyveck *w, const polyveck *u, const polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_add(&w->vec[i], &u->vec[i], &v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_sub
+*
+* Description: Subtract vectors of polynomials of length K.
+*              No modular reduction is performed.
+*
+* Arguments:   - polyveck *w: pointer to output vector
+*              - const polyveck *u: pointer to first input vector
+*              - const polyveck *v: pointer to second input vector to be
+*                                   subtracted from first input vector
+**************************************************/
+void polyveck_sub(polyveck *w, const polyveck *u, const polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_sub(&w->vec[i], &u->vec[i], &v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_shiftl
+*
+* Description: Multiply vector of polynomials of Length K by 2^D without modular
+*              reduction. Assumes input coefficients to be less than 2^{31-D}.
+*
+* Arguments:   - polyveck *v: pointer to input/output vector
+**************************************************/
+void polyveck_shiftl(polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_shiftl(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_ntt
+*
+* Description: Forward NTT of all polynomials in vector of length K. Output
+*              coefficients can be up to 16*Q larger than input coefficients.
+*
+* Arguments:   - polyveck *v: pointer to input/output vector
+**************************************************/
+void polyveck_ntt(polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_ntt(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_invntt_tomont
+*
+* Description: Inverse NTT and multiplication by 2^{32} of polynomials
+*              in vector of length K. Input coefficients need to be less
+*              than 2*Q.
+*
+* Arguments:   - polyveck *v: pointer to input/output vector
+**************************************************/
+void polyveck_invntt_tomont(polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_invntt_tomont(&v->vec[i]);
+    }
+}
+
+void polyveck_pointwise_poly_montgomery(polyveck *r, const poly *a, const polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_pointwise_montgomery(&r->vec[i], a, &v->vec[i]);
+    }
+}
+
+
+/*************************************************
+* Name:        polyveck_chknorm
+*
+* Description: Check infinity norm of polynomials in vector of length K.
+*              Assumes input polyveck to be reduced by polyveck_reduce().
+*
+* Arguments:   - const polyveck *v: pointer to vector
+*              - int32_t B: norm bound
+*
+* Returns 0 if norm of all polynomials are strictly smaller than B <= (Q-1)/8
+* and 1 otherwise.
+**************************************************/
+int polyveck_chknorm(const polyveck *v, int32_t bound) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        if (poly_chknorm(&v->vec[i], bound)) {
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
+/*************************************************
+* Name:        polyveck_power2round
+*
+* Description: For all coefficients a of polynomials in vector of length K,
+*              compute a0, a1 such that a mod^+ Q = a1*2^D + a0
+*              with -2^{D-1} < a0 <= 2^{D-1}. Assumes coefficients to be
+*              standard representatives.
+*
+* Arguments:   - polyveck *v1: pointer to output vector of polynomials with
+*                              coefficients a1
+*              - polyveck *v0: pointer to output vector of polynomials with
+*                              coefficients a0
+*              - const polyveck *v: pointer to input vector
+**************************************************/
+void polyveck_power2round(polyveck *v1, polyveck *v0, const polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_power2round(&v1->vec[i], &v0->vec[i], &v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_decompose
+*
+* Description: For all coefficients a of polynomials in vector of length K,
+*              compute high and low bits a0, a1 such a mod^+ Q = a1*ALPHA + a0
+*              with -ALPHA/2 < a0 <= ALPHA/2 except a1 = (Q-1)/ALPHA where we
+*              set a1 = 0 and -ALPHA/2 <= a0 = a mod Q - Q < 0.
+*              Assumes coefficients to be standard representatives.
+*
+* Arguments:   - polyveck *v1: pointer to output vector of polynomials with
+*                              coefficients a1
+*              - polyveck *v0: pointer to output vector of polynomials with
+*                              coefficients a0
+*              - const polyveck *v: pointer to input vector
+**************************************************/
+void polyveck_decompose(polyveck *v1, polyveck *v0, const polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_decompose(&v1->vec[i], &v0->vec[i], &v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_make_hint
+*
+* Description: Compute hint vector.
+*
+* Arguments:   - polyveck *h: pointer to output vector
+*              - const polyveck *v0: pointer to low part of input vector
+*              - const polyveck *v1: pointer to high part of input vector
+*
+* Returns number of 1 bits.
+**************************************************/
+unsigned int polyveck_make_hint(polyveck *h,
+                                const polyveck *v0,
+                                const polyveck *v1) {
+    unsigned int i, s = 0;
+
+    for (i = 0; i < K; ++i) {
+        s += poly_make_hint(&h->vec[i], &v0->vec[i], &v1->vec[i]);
+    }
+
+    return s;
+}
+
+/*************************************************
+* Name:        polyveck_use_hint
+*
+* Description: Use hint vector to correct the high bits of input vector.
+*
+* Arguments:   - polyveck *w: pointer to output vector of polynomials with
+*                             corrected high bits
+*              - const polyveck *u: pointer to input vector
+*              - const polyveck *h: pointer to input hint vector
+**************************************************/
+void polyveck_use_hint(polyveck *w, const polyveck *u, const polyveck *h) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_use_hint(&w->vec[i], &u->vec[i], &h->vec[i]);
+    }
+}
+
+void polyveck_pack_w1(uint8_t r[K * POLYW1_PACKEDBYTES], const polyveck *w1) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        polyw1_pack(&r[i * POLYW1_PACKEDBYTES], &w1->vec[i]);
+    }
+}

src/sign/dilithium/dilithium2/aarch64/polyvec.h

@@ -0,0 +1,96 @@
+#ifndef POLYVEC_H
+#define POLYVEC_H
+#include "params.h"
+#include "poly.h"
+#include <stdint.h>
+
+/* Vectors of polynomials of length L */
+typedef struct {
+    poly vec[L];
+} polyvecl;
+
+#define polyvecl_uniform_eta DILITHIUM_NAMESPACE(polyvecl_uniform_eta)
+void polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
+
+#define polyvecl_uniform_gamma1 DILITHIUM_NAMESPACE(polyvecl_uniform_gamma1)
+void polyvecl_uniform_gamma1(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
+
+#define polyvecl_reduce DILITHIUM_NAMESPACE(polyvecl_reduce)
+void polyvecl_reduce(polyvecl *v);
+
+#define polyvecl_freeze DILITHIUM_NAMESPACE(polyvecl_freeze)
+void polyvecl_freeze(polyvecl *v);
+
+#define polyvecl_add DILITHIUM_NAMESPACE(polyvecl_add)
+void polyvecl_add(polyvecl *w, const polyvecl *u, const polyvecl *v);
+
+#define polyvecl_ntt DILITHIUM_NAMESPACE(polyvecl_ntt)
+void polyvecl_ntt(polyvecl *v);
+#define polyvecl_invntt_tomont DILITHIUM_NAMESPACE(polyvecl_invntt_tomont)
+void polyvecl_invntt_tomont(polyvecl *v);
+#define polyvecl_pointwise_poly_montgomery DILITHIUM_NAMESPACE(polyvecl_pointwise_poly_montgomery)
+void polyvecl_pointwise_poly_montgomery(polyvecl *r, const poly *a, const polyvecl *v);
+#define polyvecl_pointwise_acc_montgomery DILITHIUM_NAMESPACE(polyvecl_pointwise_acc_montgomery)
+void polyvecl_pointwise_acc_montgomery(poly *w,
+                                       const polyvecl *u,
+                                       const polyvecl *v);
+
+
+#define polyvecl_chknorm DILITHIUM_NAMESPACE(polyvecl_chknorm)
+int polyvecl_chknorm(const polyvecl *v, int32_t B);
+
+
+
+/* Vectors of polynomials of length K */
+typedef struct {
+    poly vec[K];
+} polyveck;
+
+#define polyveck_uniform_eta DILITHIUM_NAMESPACE(polyveck_uniform_eta)
+void polyveck_uniform_eta(polyveck *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
+
+#define polyveck_reduce DILITHIUM_NAMESPACE(polyveck_reduce)
+void polyveck_reduce(polyveck *v);
+#define polyveck_caddq DILITHIUM_NAMESPACE(polyveck_caddq)
+void polyveck_caddq(polyveck *v);
+#define polyveck_freeze DILITHIUM_NAMESPACE(polyveck_freeze)
+void polyveck_freeze(polyveck *v);
+
+#define polyveck_add DILITHIUM_NAMESPACE(polyveck_add)
+void polyveck_add(polyveck *w, const polyveck *u, const polyveck *v);
+#define polyveck_sub DILITHIUM_NAMESPACE(polyveck_sub)
+void polyveck_sub(polyveck *w, const polyveck *u, const polyveck *v);
+#define polyveck_shiftl DILITHIUM_NAMESPACE(polyveck_shiftl)
+void polyveck_shiftl(polyveck *v);
+
+#define polyveck_ntt DILITHIUM_NAMESPACE(polyveck_ntt)
+void polyveck_ntt(polyveck *v);
+#define polyveck_invntt_tomont DILITHIUM_NAMESPACE(polyveck_invntt_tomont)
+void polyveck_invntt_tomont(polyveck *v);
+#define polyveck_pointwise_poly_montgomery DILITHIUM_NAMESPACE(polyveck_pointwise_poly_montgomery)
+void polyveck_pointwise_poly_montgomery(polyveck *r, const poly *a, const polyveck *v);
+
+#define polyveck_chknorm DILITHIUM_NAMESPACE(polyveck_chknorm)
+int polyveck_chknorm(const polyveck *v, int32_t B);
+
+#define polyveck_power2round DILITHIUM_NAMESPACE(polyveck_power2round)
+void polyveck_power2round(polyveck *v1, polyveck *v0, const polyveck *v);
+#define polyveck_decompose DILITHIUM_NAMESPACE(polyveck_decompose)
+void polyveck_decompose(polyveck *v1, polyveck *v0, const polyveck *v);
+#define polyveck_make_hint DILITHIUM_NAMESPACE(polyveck_make_hint)
+unsigned int polyveck_make_hint(polyveck *h,
+                                const polyveck *v0,
+                                const polyveck *v1);
+#define polyveck_use_hint DILITHIUM_NAMESPACE(polyveck_use_hint)
+void polyveck_use_hint(polyveck *w, const polyveck *u, const polyveck *h);
+
+#define polyveck_pack_w1 DILITHIUM_NAMESPACE(polyveck_pack_w1)
+void polyveck_pack_w1(uint8_t r[K * POLYW1_PACKEDBYTES], const polyveck *w1);
+
+#define polyvec_matrix_expand DILITHIUM_NAMESPACE(polyvec_matrix_expand)
+void polyvec_matrix_expand(polyvecl mat[K], const uint8_t rho[SEEDBYTES]);
+
+#define polyvec_matrix_pointwise_montgomery DILITHIUM_NAMESPACE(polyvec_matrix_pointwise_montgomery)
+void polyvec_matrix_pointwise_montgomery(polyveck *t, const polyvecl mat[K], const polyvecl *v);
+
+#endif

src/sign/dilithium/dilithium2/aarch64/reduce.c

@@ -0,0 +1,69 @@
+#include "params.h"
+#include "reduce.h"
+#include <stdint.h>
+
+/*************************************************
+* Name:        montgomery_reduce
+*
+* Description: For finite field element a with -2^{31}Q <= a <= Q*2^31,
+*              compute r \equiv a*2^{-32} (mod Q) such that -Q < r < Q.
+*
+* Arguments:   - int64_t: finite field element a
+*
+* Returns r.
+**************************************************/
+int32_t montgomery_reduce(int64_t a) {
+    int32_t t;
+
+    t = (int32_t)((uint64_t)a * (uint64_t)DILITHIUM_QINV);
+    t = (a - (int64_t)t * DILITHIUM_Q) >> 32;
+    return t;
+}
+
+/*************************************************
+* Name:        reduce32
+*
+* Description: For finite field element a with a <= 2^{31} - 2^{22} - 1,
+*              compute r \equiv a (mod Q) such that -6283009 <= r <= 6283007.
+*
+* Arguments:   - int32_t: finite field element a
+*
+* Returns r.
+**************************************************/
+int32_t reduce32(int32_t a) {
+    int32_t t;
+
+    t = (a + (1 << 22)) >> 23;
+    t = a - t * DILITHIUM_Q;
+    return t;
+}
+
+/*************************************************
+* Name:        caddq
+*
+* Description: Add Q if input coefficient is negative.
+*
+* Arguments:   - int32_t: finite field element a
+*
+* Returns r.
+**************************************************/
+int32_t caddq(int32_t a) {
+    a += (a >> 31) & DILITHIUM_Q;
+    return a;
+}
+
+/*************************************************
+* Name:        freeze
+*
+* Description: For finite field element a, compute standard
+*              representative r = a mod^+ Q.
+*
+* Arguments:   - int32_t: finite field element a
+*
+* Returns r.
+**************************************************/
+int32_t freeze(int32_t a) {
+    a = reduce32(a);
+    a = caddq(a);
+    return a;
+}

src/sign/dilithium/dilithium2/aarch64/reduce.h

@@ -0,0 +1,20 @@
+#ifndef REDUCE_H
+#define REDUCE_H
+#include "params.h"
+#include <stdint.h>
+
+#define DILITHIUM_QINV 58728449 // q^(-1) mod 2^32
+
+#define montgomery_reduce DILITHIUM_NAMESPACE(montgomery_reduce)
+int32_t montgomery_reduce(int64_t a);
+
+#define reduce32 DILITHIUM_NAMESPACE(reduce32)
+int32_t reduce32(int32_t a);
+
+#define caddq DILITHIUM_NAMESPACE(caddq)
+int32_t caddq(int32_t a);
+
+#define freeze DILITHIUM_NAMESPACE(freeze)
+int32_t freeze(int32_t a);
+
+#endif

src/sign/dilithium/dilithium2/aarch64/rounding.c

@@ -0,0 +1,96 @@
+#include "params.h"
+#include "rounding.h"
+#include <stdint.h>
+
+/*************************************************
+* Name:        power2round
+*
+* Description: For finite field element a, compute a0, a1 such that
+*              a mod^+ Q = a1*2^D + a0 with -2^{D-1} < a0 <= 2^{D-1}.
+*              Assumes a to be standard representative.
+*
+* Arguments:   - int32_t a: input element
+*              - int32_t *a0: pointer to output element a0
+*
+* Returns a1.
+**************************************************/
+int32_t power2round(int32_t *a0, int32_t a)  {
+    int32_t a1;
+
+    a1 = (a + (1 << (D - 1)) - 1) >> D;
+    *a0 = a - (a1 << D);
+    return a1;
+}
+
+/*************************************************
+* Name:        decompose
+*
+* Description: For finite field element a, compute high and low bits a0, a1 such
+*              that a mod^+ Q = a1*ALPHA + a0 with -ALPHA/2 < a0 <= ALPHA/2 except
+*              if a1 = (Q-1)/ALPHA where we set a1 = 0 and
+*              -ALPHA/2 <= a0 = a mod^+ Q - Q < 0. Assumes a to be standard
+*              representative.
+*
+* Arguments:   - int32_t a: input element
+*              - int32_t *a0: pointer to output element a0
+*
+* Returns a1.
+**************************************************/
+int32_t decompose(int32_t *a0, int32_t a) {
+    int32_t a1;
+
+    a1  = (a + 127) >> 7;
+
+    a1  = (a1 * 11275 + (1 << 23)) >> 24;
+    a1 ^= ((43 - a1) >> 31) & a1;
+
+
+    *a0  = a - a1 * 2 * GAMMA2;
+    *a0 -= (((DILITHIUM_Q - 1) / 2 - *a0) >> 31) & DILITHIUM_Q;
+    return a1;
+}
+
+/*************************************************
+* Name:        make_hint
+*
+* Description: Compute hint bit indicating whether the low bits of the
+*              input element overflow into the high bits.
+*
+* Arguments:   - int32_t a0: low bits of input element
+*              - int32_t a1: high bits of input element
+*
+* Returns 1 if overflow.
+**************************************************/
+unsigned int make_hint(int32_t a0, int32_t a1) {
+    if (a0 > GAMMA2 || a0 < -GAMMA2 || (a0 == -GAMMA2 && a1 != 0)) {
+        return 1;
+    }
+
+    return 0;
+}
+
+/*************************************************
+* Name:        use_hint
+*
+* Description: Correct high bits according to hint.
+*
+* Arguments:   - int32_t a: input element
+*              - unsigned int hint: hint bit
+*
+* Returns corrected high bits.
+**************************************************/
+int32_t use_hint(int32_t a, unsigned int hint) {
+    int32_t a0, a1;
+
+    a1 = decompose(&a0, a);
+    if (hint == 0) {
+        return a1;
+    }
+
+
+    if (a0 > 0) {
+        return (a1 == 43) ?  0 : a1 + 1;
+    }
+    return (a1 ==  0) ? 43 : a1 - 1;
+
+}

src/sign/dilithium/dilithium2/aarch64/rounding.h

@@ -0,0 +1,18 @@
+#ifndef ROUNDING_H
+#define ROUNDING_H
+#include "params.h"
+#include <stdint.h>
+
+#define power2round DILITHIUM_NAMESPACE(power2round)
+int32_t power2round(int32_t *a0, int32_t a);
+
+#define decompose DILITHIUM_NAMESPACE(decompose)
+int32_t decompose(int32_t *a0, int32_t a);
+
+#define make_hint DILITHIUM_NAMESPACE(make_hint)
+unsigned int make_hint(int32_t a0, int32_t a1);
+
+#define use_hint DILITHIUM_NAMESPACE(use_hint)
+int32_t use_hint(int32_t a, unsigned int hint);
+
+#endif

src/sign/dilithium/dilithium2/aarch64/sign.c

@@ -0,0 +1,343 @@
+#include "fips202.h"
+#include "packing.h"
+#include "params.h"
+#include "poly.h"
+#include "polyvec.h"
+#include "randombytes.h"
+#include "sign.h"
+#include "symmetric.h"
+#include <stdint.h>
+
+/*************************************************
+* Name:        crypto_sign_keypair
+*
+* Description: Generates public and private key.
+*
+* Arguments:   - uint8_t *pk: pointer to output public key (allocated
+*                             array of CRYPTO_PUBLICKEYBYTES bytes)
+*              - uint8_t *sk: pointer to output private key (allocated
+*                             array of CRYPTO_SECRETKEYBYTES bytes)
+*
+* Returns 0 (success)
+**************************************************/
+int crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
+    uint8_t seedbuf[2 * SEEDBYTES + CRHBYTES];
+    uint8_t tr[SEEDBYTES];
+    const uint8_t *rho, *rhoprime, *key;
+    polyvecl mat[K];
+    polyvecl s1, s1hat;
+    polyveck s2, t1, t0;
+
+    /* Get randomness for rho, rhoprime and key */
+    randombytes(seedbuf, SEEDBYTES);
+    shake256(seedbuf, 2 * SEEDBYTES + CRHBYTES, seedbuf, SEEDBYTES);
+    rho = seedbuf;
+    rhoprime = rho + SEEDBYTES;
+    key = rhoprime + CRHBYTES;
+
+    /* Expand matrix */
+    polyvec_matrix_expand(mat, rho);
+
+    /* Sample short vectors s1 and s2 */
+    polyvecl_uniform_eta(&s1, rhoprime, 0);
+    polyveck_uniform_eta(&s2, rhoprime, L);
+
+    /* Matrix-vector multiplication */
+    s1hat = s1;
+    polyvecl_ntt(&s1hat);
+    polyvec_matrix_pointwise_montgomery(&t1, mat, &s1hat);
+    polyveck_reduce(&t1);
+    polyveck_invntt_tomont(&t1);
+
+    /* Add error vector s2 */
+    polyveck_add(&t1, &t1, &s2);
+
+    /* Extract t1 and write public key */
+    polyveck_caddq(&t1);
+    polyveck_power2round(&t1, &t0, &t1);
+    pack_pk(pk, rho, &t1);
+
+    /* Compute H(rho, t1) and write secret key */
+    shake256(tr, SEEDBYTES, pk, CRYPTO_PUBLICKEYBYTES);
+    pack_sk(sk, rho, tr, key, &t0, &s1, &s2);
+
+    return 0;
+}
+
+/*************************************************
+* Name:        crypto_sign_signature
+*
+* Description: Computes signature.
+*
+* Arguments:   - uint8_t *sig:   pointer to output signature (of length CRYPTO_BYTES)
+*              - size_t *siglen: pointer to output length of signature
+*              - uint8_t *m:     pointer to message to be signed
+*              - size_t mlen:    length of message
+*              - uint8_t *sk:    pointer to bit-packed secret key
+*
+* Returns 0 (success)
+**************************************************/
+int crypto_sign_signature(uint8_t *sig,
+                          size_t *siglen,
+                          const uint8_t *m,
+                          size_t mlen,
+                          const uint8_t *sk) {
+    unsigned int n;
+    uint8_t seedbuf[3 * SEEDBYTES + 2 * CRHBYTES];
+    uint8_t *rho, *tr, *key, *mu, *rhoprime;
+    uint16_t nonce = 0;
+    polyvecl mat[K], s1, y, z;
+    polyveck t0, s2, w1, w0, h;
+    poly cp;
+    shake256incctx state;
+
+    rho = seedbuf;
+    tr = rho + SEEDBYTES;
+    key = tr + SEEDBYTES;
+    mu = key + SEEDBYTES;
+    rhoprime = mu + CRHBYTES;
+    unpack_sk(rho, tr, key, &t0, &s1, &s2, sk);
+
+    /* Compute CRH(tr, msg) */
+    shake256_inc_init(&state);
+    shake256_inc_absorb(&state, tr, SEEDBYTES);
+    shake256_inc_absorb(&state, m, mlen);
+    shake256_inc_finalize(&state);
+    shake256_inc_squeeze(mu, CRHBYTES, &state);
+    shake256_inc_ctx_release(&state);
+
+    shake256(rhoprime, CRHBYTES, key, SEEDBYTES + CRHBYTES);
+
+    /* Expand matrix and transform vectors */
+    polyvec_matrix_expand(mat, rho);
+    polyvecl_ntt(&s1);
+    polyveck_ntt(&s2);
+    polyveck_ntt(&t0);
+
+rej:
+    /* Sample intermediate vector y */
+    polyvecl_uniform_gamma1(&y, rhoprime, nonce++);
+
+    /* Matrix-vector multiplication */
+    z = y;
+    polyvecl_ntt(&z);
+    polyvec_matrix_pointwise_montgomery(&w1, mat, &z);
+    polyveck_reduce(&w1);
+    polyveck_invntt_tomont(&w1);
+
+    /* Decompose w and call the random oracle */
+    polyveck_caddq(&w1);
+    polyveck_decompose(&w1, &w0, &w1);
+    polyveck_pack_w1(sig, &w1);
+
+    shake256_inc_init(&state);
+    shake256_inc_absorb(&state, mu, CRHBYTES);
+    shake256_inc_absorb(&state, sig, K * POLYW1_PACKEDBYTES);
+    shake256_inc_finalize(&state);
+    shake256_inc_squeeze(sig, SEEDBYTES, &state);
+    shake256_inc_ctx_release(&state);
+    poly_challenge(&cp, sig);
+    poly_ntt(&cp);
+
+    /* Compute z, reject if it reveals secret */
+    polyvecl_pointwise_poly_montgomery(&z, &cp, &s1);
+    polyvecl_invntt_tomont(&z);
+    polyvecl_add(&z, &z, &y);
+    polyvecl_reduce(&z);
+    if (polyvecl_chknorm(&z, GAMMA1 - BETA)) {
+        goto rej;
+    }
+
+    /* Check that subtracting cs2 does not change high bits of w and low bits
+     * do not reveal secret information */
+    polyveck_pointwise_poly_montgomery(&h, &cp, &s2);
+    polyveck_invntt_tomont(&h);
+    polyveck_sub(&w0, &w0, &h);
+    polyveck_reduce(&w0);
+    if (polyveck_chknorm(&w0, GAMMA2 - BETA)) {
+        goto rej;
+    }
+
+    /* Compute hints for w1 */
+    polyveck_pointwise_poly_montgomery(&h, &cp, &t0);
+    polyveck_invntt_tomont(&h);
+    polyveck_reduce(&h);
+    if (polyveck_chknorm(&h, GAMMA2)) {
+        goto rej;
+    }
+
+    polyveck_add(&w0, &w0, &h);
+    n = polyveck_make_hint(&h, &w0, &w1);
+    if (n > OMEGA) {
+        goto rej;
+    }
+
+    /* Write signature */
+    pack_sig(sig, sig, &z, &h);
+    *siglen = CRYPTO_BYTES;
+    return 0;
+}
+
+/*************************************************
+* Name:        crypto_sign
+*
+* Description: Compute signed message.
+*
+* Arguments:   - uint8_t *sm: pointer to output signed message (allocated
+*                             array with CRYPTO_BYTES + mlen bytes),
+*                             can be equal to m
+*              - size_t *smlen: pointer to output length of signed
+*                               message
+*              - const uint8_t *m: pointer to message to be signed
+*              - size_t mlen: length of message
+*              - const uint8_t *sk: pointer to bit-packed secret key
+*
+* Returns 0 (success)
+**************************************************/
+int crypto_sign(uint8_t *sm,
+                size_t *smlen,
+                const uint8_t *m,
+                size_t mlen,
+                const uint8_t *sk) {
+    size_t i;
+
+    for (i = 0; i < mlen; ++i) {
+        sm[CRYPTO_BYTES + mlen - 1 - i] = m[mlen - 1 - i];
+    }
+    crypto_sign_signature(sm, smlen, sm + CRYPTO_BYTES, mlen, sk);
+    *smlen += mlen;
+    return 0;
+}
+
+/*************************************************
+* Name:        crypto_sign_verify
+*
+* Description: Verifies signature.
+*
+* Arguments:   - uint8_t *m: pointer to input signature
+*              - size_t siglen: length of signature
+*              - const uint8_t *m: pointer to message
+*              - size_t mlen: length of message
+*              - const uint8_t *pk: pointer to bit-packed public key
+*
+* Returns 0 if signature could be verified correctly and -1 otherwise
+**************************************************/
+int crypto_sign_verify(const uint8_t *sig,
+                       size_t siglen,
+                       const uint8_t *m,
+                       size_t mlen,
+                       const uint8_t *pk) {
+    unsigned int i;
+    uint8_t buf[K * POLYW1_PACKEDBYTES];
+    uint8_t rho[SEEDBYTES];
+    uint8_t mu[CRHBYTES];
+    uint8_t c[SEEDBYTES];
+    uint8_t c2[SEEDBYTES];
+    poly cp;
+    polyvecl mat[K], z;
+    polyveck t1, w1, h;
+    shake256incctx state;
+
+    if (siglen != CRYPTO_BYTES) {
+        return -1;
+    }
+
+    unpack_pk(rho, &t1, pk);
+    if (unpack_sig(c, &z, &h, sig)) {
+        return -1;
+    }
+    if (polyvecl_chknorm(&z, GAMMA1 - BETA)) {
+        return -1;
+    }
+
+    /* Compute CRH(H(rho, t1), msg) */
+    shake256(mu, SEEDBYTES, pk, CRYPTO_PUBLICKEYBYTES);
+    shake256_inc_init(&state);
+    shake256_inc_absorb(&state, mu, SEEDBYTES);
+    shake256_inc_absorb(&state, m, mlen);
+    shake256_inc_finalize(&state);
+    shake256_inc_squeeze(mu, CRHBYTES, &state);
+    shake256_inc_ctx_release(&state);
+
+    /* Matrix-vector multiplication; compute Az - c2^dt1 */
+    poly_challenge(&cp, c);
+    polyvec_matrix_expand(mat, rho);
+
+    polyvecl_ntt(&z);
+    polyvec_matrix_pointwise_montgomery(&w1, mat, &z);
+
+    poly_ntt(&cp);
+    polyveck_shiftl(&t1);
+    polyveck_ntt(&t1);
+    polyveck_pointwise_poly_montgomery(&t1, &cp, &t1);
+
+    polyveck_sub(&w1, &w1, &t1);
+    polyveck_reduce(&w1);
+    polyveck_invntt_tomont(&w1);
+
+    /* Reconstruct w1 */
+    polyveck_caddq(&w1);
+    polyveck_use_hint(&w1, &w1, &h);
+    polyveck_pack_w1(buf, &w1);
+
+    /* Call random oracle and verify challenge */
+    shake256_inc_init(&state);
+    shake256_inc_absorb(&state, mu, CRHBYTES);
+    shake256_inc_absorb(&state, buf, K * POLYW1_PACKEDBYTES);
+    shake256_inc_finalize(&state);
+    shake256_inc_squeeze(c2, SEEDBYTES, &state);
+    shake256_inc_ctx_release(&state);
+    for (i = 0; i < SEEDBYTES; ++i) {
+        if (c[i] != c2[i]) {
+            return -1;
+        }
+    }
+
+    return 0;
+}
+
+/*************************************************
+* Name:        crypto_sign_open
+*
+* Description: Verify signed message.
+*
+* Arguments:   - uint8_t *m: pointer to output message (allocated
+*                            array with smlen bytes), can be equal to sm
+*              - size_t *mlen: pointer to output length of message
+*              - const uint8_t *sm: pointer to signed message
+*              - size_t smlen: length of signed message
+*              - const uint8_t *pk: pointer to bit-packed public key
+*
+* Returns 0 if signed message could be verified correctly and -1 otherwise
+**************************************************/
+int crypto_sign_open(uint8_t *m,
+                     size_t *mlen,
+                     const uint8_t *sm,
+                     size_t smlen,
+                     const uint8_t *pk) {
+    size_t i;
+
+    if (smlen < CRYPTO_BYTES) {
+        goto badsig;
+    }
+
+    *mlen = smlen - CRYPTO_BYTES;
+    if (crypto_sign_verify(sm, CRYPTO_BYTES, sm + CRYPTO_BYTES, *mlen, pk)) {
+        goto badsig;
+    } else {
+        /* All good, copy msg, return 0 */
+        for (i = 0; i < *mlen; ++i) {
+            m[i] = sm[CRYPTO_BYTES + i];
+        }
+        return 0;
+    }
+
+badsig:
+    /* Signature verification failed */
+    *mlen = (size_t) -1;
+    for (i = 0; i < smlen; ++i) {
+        m[i] = 0;
+    }
+
+    return -1;
+}

src/sign/dilithium/dilithium2/aarch64/sign.h

@@ -0,0 +1,37 @@
+#ifndef SIGN_H
+#define SIGN_H
+#include "params.h"
+#include "poly.h"
+#include "polyvec.h"
+#include <stddef.h>
+#include <stdint.h>
+
+
+
+#define challenge DILITHIUM_NAMESPACE(challenge)
+void challenge(poly *c, const uint8_t seed[SEEDBYTES]);
+
+#define crypto_sign_keypair DILITHIUM_NAMESPACE(crypto_sign_keypair)
+int crypto_sign_keypair(uint8_t *pk, uint8_t *sk);
+
+#define crypto_sign_signature DILITHIUM_NAMESPACE(crypto_sign_signature)
+int crypto_sign_signature(uint8_t *sig, size_t *siglen,
+                          const uint8_t *m, size_t mlen,
+                          const uint8_t *sk);
+
+#define crypto_sign DILITHIUM_NAMESPACETOP
+int crypto_sign(uint8_t *sm, size_t *smlen,
+                const uint8_t *m, size_t mlen,
+                const uint8_t *sk);
+
+#define crypto_sign_verify DILITHIUM_NAMESPACE(crypto_sign_verify)
+int crypto_sign_verify(const uint8_t *sig, size_t siglen,
+                       const uint8_t *m, size_t mlen,
+                       const uint8_t *pk);
+
+#define crypto_sign_open DILITHIUM_NAMESPACE(crypto_sign_open)
+int crypto_sign_open(uint8_t *m, size_t *mlen,
+                     const uint8_t *sm, size_t smlen,
+                     const uint8_t *pk);
+
+#endif

src/sign/dilithium/dilithium2/aarch64/symmetric-shake.c

@@ -0,0 +1,66 @@
+#include "fips202.h"
+#include "params.h"
+#include "symmetric.h"
+#include <stdint.h>
+
+void dilithium_shake128_stream_init(shake128incctx *state, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
+    uint8_t t[2];
+    t[0] = (uint8_t) nonce;
+    t[1] = (uint8_t) (nonce >> 8);
+
+    shake128_inc_init(state);
+    shake128_inc_absorb(state, seed, SEEDBYTES);
+    shake128_inc_absorb(state, t, 2);
+    shake128_inc_finalize(state);
+}
+
+void dilithium_shake256_stream_init(shake256incctx *state, const uint8_t seed[CRHBYTES], uint16_t nonce) {
+    uint8_t t[2];
+    t[0] = (uint8_t) nonce;
+    t[1] = (uint8_t) (nonce >> 8);
+
+    shake256_inc_init(state);
+    shake256_inc_absorb(state, seed, CRHBYTES);
+    shake256_inc_absorb(state, t, 2);
+    shake256_inc_finalize(state);
+}
+
+void dilithium_shake128x2_stream_init(keccakx2_state *state,
+                                      const uint8_t seed[SEEDBYTES],
+                                      uint16_t nonce1, uint16_t nonce2) {
+    unsigned int i;
+    uint8_t extseed1[SEEDBYTES + 2 + 14];
+    uint8_t extseed2[SEEDBYTES + 2 + 14];
+
+    for (i = 0; i < SEEDBYTES; i++) {
+        extseed1[i] = seed[i];
+        extseed2[i] = seed[i];
+    }
+    extseed1[SEEDBYTES] = (uint8_t) nonce1;
+    extseed1[SEEDBYTES + 1] = (uint8_t) (nonce1 >> 8);
+
+    extseed2[SEEDBYTES  ] = (uint8_t) nonce2;
+    extseed2[SEEDBYTES + 1] = (uint8_t) (nonce2 >> 8);
+
+    shake128x2_absorb(state, extseed1, extseed2, SEEDBYTES + 2);
+}
+
+void dilithium_shake256x2_stream_init(keccakx2_state *state,
+                                      const uint8_t seed[CRHBYTES],
+                                      uint16_t nonce1, uint16_t nonce2) {
+    unsigned int i;
+    uint8_t extseed1[CRHBYTES + 2 + 14];
+    uint8_t extseed2[CRHBYTES + 2 + 14];
+
+    for (i = 0; i < CRHBYTES; i++) {
+        extseed1[i] = seed[i];
+        extseed2[i] = seed[i];
+    }
+    extseed1[CRHBYTES] = (uint8_t) nonce1;
+    extseed1[CRHBYTES + 1] = (uint8_t) (nonce1 >> 8);
+
+    extseed2[CRHBYTES  ] = (uint8_t) nonce2;
+    extseed2[CRHBYTES + 1] = (uint8_t) (nonce2 >> 8);
+
+    shake256x2_absorb(state, extseed1, extseed2, CRHBYTES + 2);
+}

src/sign/dilithium/dilithium2/aarch64/symmetric.h

@@ -0,0 +1,47 @@
+#ifndef SYMMETRIC_H
+#define SYMMETRIC_H
+#include "fips202.h"
+#include "fips202x2.h"
+#include "params.h"
+#include <stdint.h>
+
+
+typedef shake128incctx stream128_state;
+typedef shake256incctx stream256_state;
+
+#define dilithium_shake128_stream_init DILITHIUM_NAMESPACE(dilithium_shake128_stream_init)
+void dilithium_shake128_stream_init(shake128incctx *state,
+                                    const uint8_t seed[SEEDBYTES],
+                                    uint16_t nonce);
+
+#define dilithium_shake256_stream_init DILITHIUM_NAMESPACE(dilithium_shake256_stream_init)
+void dilithium_shake256_stream_init(shake256incctx *state,
+                                    const uint8_t seed[CRHBYTES],
+                                    uint16_t nonce);
+
+#define dilithium_shake128x2_stream_init DILITHIUM_NAMESPACE(dilithium_shake128x2_stream_init)
+void dilithium_shake128x2_stream_init(keccakx2_state *state,
+                                      const uint8_t seed[SEEDBYTES],
+                                      uint16_t nonce1, uint16_t nonce2);
+#define dilithium_shake256x2_stream_init DILITHIUM_NAMESPACE(dilithium_shake256x2_stream_init)
+void dilithium_shake256x2_stream_init(keccakx2_state *state,
+                                      const uint8_t seed[CRHBYTES],
+                                      uint16_t nonce1, uint16_t nonce2);
+
+
+#define STREAM128_BLOCKBYTES SHAKE128_RATE
+#define STREAM256_BLOCKBYTES SHAKE256_RATE
+
+#define stream128_init(STATE, SEED, NONCE) \
+    dilithium_shake128_stream_init(STATE, SEED, NONCE)
+#define stream128_squeezeblocks(OUT, OUTBLOCKS, STATE) \
+    shake128_inc_squeeze(OUT, (OUTBLOCKS)*(SHAKE128_RATE), STATE)
+#define stream128_release(STATE) shake128_inc_ctx_release(STATE)
+#define stream256_init(STATE, SEED, NONCE) \
+    dilithium_shake256_stream_init(STATE, SEED, NONCE)
+#define stream256_squeezeblocks(OUT, OUTBLOCKS, STATE) \
+    shake256_inc_squeeze(OUT, (OUTBLOCKS)*(SHAKE256_RATE), STATE)
+#define stream256_release(STATE) shake256_inc_ctx_release(STATE)
+
+
+#endif

src/sign/dilithium/dilithium2/avx2/api.h

@@ -5,7 +5,7 @@
 #include <stdint.h>
 
 #define PQCLEAN_DILITHIUM2_AVX2_CRYPTO_PUBLICKEYBYTES 1312
-#define PQCLEAN_DILITHIUM2_AVX2_CRYPTO_SECRETKEYBYTES 2544
+#define PQCLEAN_DILITHIUM2_AVX2_CRYPTO_SECRETKEYBYTES 2528
 #define PQCLEAN_DILITHIUM2_AVX2_CRYPTO_BYTES 2420
 #define PQCLEAN_DILITHIUM2_AVX2_CRYPTO_ALGNAME "Dilithium2"
 

src/sign/dilithium/dilithium2/avx2/fips202x4.c

@@ -91,17 +91,22 @@ static void keccakx4_squeezeblocks(uint8_t *out0,
                                    unsigned int r,
                                    __m256i s[25]) {
     unsigned int i;
+    double temp0, temp1;
     __m128d t;
 
     while (nblocks > 0) {
         PQCLEAN_DILITHIUM2_AVX2_f1600x4(s, KeccakF_RoundConstants);
         for (i = 0; i < r / 8; ++i) {
             t = _mm_castsi128_pd(_mm256_castsi256_si128(s[i]));
-            _mm_storel_pd((double *)&out0[8 * i], t);
-            _mm_storeh_pd((double *)&out1[8 * i], t);
+            _mm_storel_pd(&temp0, t);
+            _mm_storeh_pd(&temp1, t);
+            memcpy(&out0[8 * i], &temp0, sizeof(double));
+            memcpy(&out1[8 * i], &temp1, sizeof(double));
             t = _mm_castsi128_pd(_mm256_extracti128_si256(s[i], 1));
-            _mm_storel_pd((double *)&out2[8 * i], t);
-            _mm_storeh_pd((double *)&out3[8 * i], t);
+            _mm_storel_pd(&temp0, t);
+            _mm_storeh_pd(&temp1, t);
+            memcpy(&out2[8 * i], &temp0, sizeof(double));
+            memcpy(&out3[8 * i], &temp1, sizeof(double));
         }
 
         out0 += r;

src/sign/dilithium/dilithium2/avx2/packing.c

@@ -67,7 +67,7 @@ void PQCLEAN_DILITHIUM2_AVX2_unpack_pk(uint8_t rho[SEEDBYTES],
 **************************************************/
 void PQCLEAN_DILITHIUM2_AVX2_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM2_AVX2_CRYPTO_SECRETKEYBYTES],
                                      const uint8_t rho[SEEDBYTES],
-                                     const uint8_t tr[CRHBYTES],
+                                     const uint8_t tr[SEEDBYTES],
                                      const uint8_t key[SEEDBYTES],
                                      const polyveck *t0,
                                      const polyvecl *s1,
@@ -84,10 +84,10 @@ void PQCLEAN_DILITHIUM2_AVX2_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM2_AVX2_CRYPTO_S
     }
     sk += SEEDBYTES;
 
-    for (i = 0; i < CRHBYTES; ++i) {
+    for (i = 0; i < SEEDBYTES; ++i) {
         sk[i] = tr[i];
     }
-    sk += CRHBYTES;
+    sk += SEEDBYTES;
 
     for (i = 0; i < L; ++i) {
         PQCLEAN_DILITHIUM2_AVX2_polyeta_pack(sk + i * POLYETA_PACKEDBYTES, &s1->vec[i]);
@@ -118,7 +118,7 @@ void PQCLEAN_DILITHIUM2_AVX2_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM2_AVX2_CRYPTO_S
 *              - uint8_t sk[]: byte array containing bit-packed sk
 **************************************************/
 void PQCLEAN_DILITHIUM2_AVX2_unpack_sk(uint8_t rho[SEEDBYTES],
-                                       uint8_t tr[CRHBYTES],
+                                       uint8_t tr[SEEDBYTES],
                                        uint8_t key[SEEDBYTES],
                                        polyveck *t0,
                                        polyvecl *s1,
@@ -136,10 +136,10 @@ void PQCLEAN_DILITHIUM2_AVX2_unpack_sk(uint8_t rho[SEEDBYTES],
     }
     sk += SEEDBYTES;
 
-    for (i = 0; i < CRHBYTES; ++i) {
+    for (i = 0; i < SEEDBYTES; ++i) {
         tr[i] = sk[i];
     }
-    sk += CRHBYTES;
+    sk += SEEDBYTES;
 
     for (i = 0; i < L; ++i) {
         PQCLEAN_DILITHIUM2_AVX2_polyeta_unpack(&s1->vec[i], sk + i * POLYETA_PACKEDBYTES);

src/sign/dilithium/dilithium2/avx2/packing.h

@@ -8,7 +8,7 @@ void PQCLEAN_DILITHIUM2_AVX2_pack_pk(uint8_t pk[PQCLEAN_DILITHIUM2_AVX2_CRYPTO_P
 
 void PQCLEAN_DILITHIUM2_AVX2_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM2_AVX2_CRYPTO_SECRETKEYBYTES],
                                      const uint8_t rho[SEEDBYTES],
-                                     const uint8_t tr[CRHBYTES],
+                                     const uint8_t tr[SEEDBYTES],
                                      const uint8_t key[SEEDBYTES],
                                      const polyveck *t0,
                                      const polyvecl *s1,
@@ -19,7 +19,7 @@ void PQCLEAN_DILITHIUM2_AVX2_pack_sig(uint8_t sig[PQCLEAN_DILITHIUM2_AVX2_CRYPTO
 void PQCLEAN_DILITHIUM2_AVX2_unpack_pk(uint8_t rho[SEEDBYTES], polyveck *t1, const uint8_t pk[PQCLEAN_DILITHIUM2_AVX2_CRYPTO_PUBLICKEYBYTES]);
 
 void PQCLEAN_DILITHIUM2_AVX2_unpack_sk(uint8_t rho[SEEDBYTES],
-                                       uint8_t tr[CRHBYTES],
+                                       uint8_t tr[SEEDBYTES],
                                        uint8_t key[SEEDBYTES],
                                        polyveck *t0,
                                        polyvecl *s1,

src/sign/dilithium/dilithium2/avx2/params.h

@@ -4,7 +4,7 @@
 
 
 #define SEEDBYTES 32
-#define CRHBYTES 48
+#define CRHBYTES 64
 #define N 256
 #define Q 8380417
 #define D 13
@@ -32,7 +32,7 @@
 #define POLYETA_PACKEDBYTES  96
 
 #define PQCLEAN_DILITHIUM2_AVX2_CRYPTO_PUBLICKEYBYTES (SEEDBYTES + K*POLYT1_PACKEDBYTES)
-#define PQCLEAN_DILITHIUM2_AVX2_CRYPTO_SECRETKEYBYTES (2*SEEDBYTES + CRHBYTES \
+#define PQCLEAN_DILITHIUM2_AVX2_CRYPTO_SECRETKEYBYTES (3*SEEDBYTES \
         + L*POLYETA_PACKEDBYTES \
         + K*POLYETA_PACKEDBYTES \
         + K*POLYT0_PACKEDBYTES)

src/sign/dilithium/dilithium2/avx2/poly.c

@@ -72,25 +72,6 @@ void PQCLEAN_DILITHIUM2_AVX2_poly_caddq(poly *a) {
     DBENCH_STOP(*tred);
 }
 
-/*************************************************
-* Name:        PQCLEAN_DILITHIUM2_AVX2_poly_freeze
-*
-* Description: Inplace reduction of all coefficients of polynomial to
-*              positive standard representatives. Assumes input
-*              coefficients to be at most 2^31 - 2^22 + 1 in
-*              absolute value.
-*
-* Arguments:   - poly *a: pointer to input/output polynomial
-**************************************************/
-void PQCLEAN_DILITHIUM2_AVX2_poly_freeze(poly *a) {
-    DBENCH_START();
-
-    PQCLEAN_DILITHIUM2_AVX2_poly_reduce(a);
-    PQCLEAN_DILITHIUM2_AVX2_poly_caddq(a);
-
-    DBENCH_STOP(*tred);
-}
-
 /*************************************************
 * Name:        PQCLEAN_DILITHIUM2_AVX2_poly_add
 *
@@ -507,34 +488,34 @@ static unsigned int rej_eta(int32_t *a,
 *              or AES256CTR(seed,nonce).
 *
 * Arguments:   - poly *a: pointer to output polynomial
-*              - const uint8_t seed[]: byte array with seed of length  SEEDBYTES
+*              - const uint8_t seed[]: byte array with seed of length CRHBYTES
 *              - uint16_t nonce: 2-byte nonce
 **************************************************/
-void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_eta_preinit(poly *a, stream128_state *state) {
+void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_eta_preinit(poly *a, stream256_state *state) {
     unsigned int ctr;
-    ALIGNED_UINT8(REJ_UNIFORM_BUFLEN * STREAM128_BLOCKBYTES) buf;
+    ALIGNED_UINT8(REJ_UNIFORM_ETA_BUFLEN) buf;
 
-    stream128_squeezeblocks(buf.coeffs, REJ_UNIFORM_ETA_NBLOCKS, state);
+    stream256_squeezeblocks(buf.coeffs, REJ_UNIFORM_ETA_NBLOCKS, state);
     ctr = PQCLEAN_DILITHIUM2_AVX2_rej_eta_avx(a->coeffs, buf.coeffs);
 
     while (ctr < N) {
-        stream128_squeezeblocks(buf.coeffs, 1, state);
-        ctr += rej_eta(a->coeffs + ctr, N - ctr, buf.coeffs, STREAM128_BLOCKBYTES);
+        stream256_squeezeblocks(buf.coeffs, 1, state);
+        ctr += rej_eta(a->coeffs + ctr, N - ctr, buf.coeffs, STREAM256_BLOCKBYTES);
     }
 }
 
-void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_eta(poly *a, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
-    stream128_state state;
-    stream128_init(&state, seed, nonce);
+void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_eta(poly *a, const uint8_t seed[CRHBYTES], uint16_t nonce) {
+    stream256_state state;
+    stream256_init(&state, seed, nonce);
     PQCLEAN_DILITHIUM2_AVX2_poly_uniform_eta_preinit(a, &state);
-    stream128_release(&state);
+    stream256_release(&state);
 }
 
 void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_eta_4x(poly *a0,
         poly *a1,
         poly *a2,
         poly *a3,
-        const uint8_t seed[32],
+        const uint8_t seed[64],
         uint16_t nonce0,
         uint16_t nonce1,
         uint16_t nonce2,
@@ -545,23 +526,28 @@ void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_eta_4x(poly *a0,
     __m256i f;
     keccakx4_state state;
 
-    f = _mm256_loadu_si256((__m256i *)seed);
-    _mm256_store_si256(buf[0].vec, f);
-    _mm256_store_si256(buf[1].vec, f);
-    _mm256_store_si256(buf[2].vec, f);
-    _mm256_store_si256(buf[3].vec, f);
-
-    buf[0].coeffs[SEEDBYTES + 0] = nonce0;
-    buf[0].coeffs[SEEDBYTES + 1] = nonce0 >> 8;
-    buf[1].coeffs[SEEDBYTES + 0] = nonce1;
-    buf[1].coeffs[SEEDBYTES + 1] = nonce1 >> 8;
-    buf[2].coeffs[SEEDBYTES + 0] = nonce2;
-    buf[2].coeffs[SEEDBYTES + 1] = nonce2 >> 8;
-    buf[3].coeffs[SEEDBYTES + 0] = nonce3;
-    buf[3].coeffs[SEEDBYTES + 1] = nonce3 >> 8;
-
-    PQCLEAN_DILITHIUM2_AVX2_shake128x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, SEEDBYTES + 2);
-    PQCLEAN_DILITHIUM2_AVX2_shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, REJ_UNIFORM_ETA_NBLOCKS, &state);
+    f = _mm256_loadu_si256((__m256i *)&seed[0]);
+    _mm256_store_si256(&buf[0].vec[0], f);
+    _mm256_store_si256(&buf[1].vec[0], f);
+    _mm256_store_si256(&buf[2].vec[0], f);
+    _mm256_store_si256(&buf[3].vec[0], f);
+    f = _mm256_loadu_si256((__m256i *)&seed[32]);
+    _mm256_store_si256(&buf[0].vec[1], f);
+    _mm256_store_si256(&buf[1].vec[1], f);
+    _mm256_store_si256(&buf[2].vec[1], f);
+    _mm256_store_si256(&buf[3].vec[1], f);
+
+    buf[0].coeffs[64] = nonce0;
+    buf[0].coeffs[65] = nonce0 >> 8;
+    buf[1].coeffs[64] = nonce1;
+    buf[1].coeffs[65] = nonce1 >> 8;
+    buf[2].coeffs[64] = nonce2;
+    buf[2].coeffs[65] = nonce2 >> 8;
+    buf[3].coeffs[64] = nonce3;
+    buf[3].coeffs[65] = nonce3 >> 8;
+
+    PQCLEAN_DILITHIUM2_AVX2_shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 66);
+    PQCLEAN_DILITHIUM2_AVX2_shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, REJ_UNIFORM_ETA_NBLOCKS, &state);
 
     ctr0 = PQCLEAN_DILITHIUM2_AVX2_rej_eta_avx(a0->coeffs, buf[0].coeffs);
     ctr1 = PQCLEAN_DILITHIUM2_AVX2_rej_eta_avx(a1->coeffs, buf[1].coeffs);
@@ -569,12 +555,12 @@ void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_eta_4x(poly *a0,
     ctr3 = PQCLEAN_DILITHIUM2_AVX2_rej_eta_avx(a3->coeffs, buf[3].coeffs);
 
     while (ctr0 < N || ctr1 < N || ctr2 < N || ctr3 < N) {
-        PQCLEAN_DILITHIUM2_AVX2_shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 1, &state);
+        PQCLEAN_DILITHIUM2_AVX2_shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 1, &state);
 
-        ctr0 += rej_eta(a0->coeffs + ctr0, N - ctr0, buf[0].coeffs, SHAKE128_RATE);
-        ctr1 += rej_eta(a1->coeffs + ctr1, N - ctr1, buf[1].coeffs, SHAKE128_RATE);
-        ctr2 += rej_eta(a2->coeffs + ctr2, N - ctr2, buf[2].coeffs, SHAKE128_RATE);
-        ctr3 += rej_eta(a3->coeffs + ctr3, N - ctr3, buf[3].coeffs, SHAKE128_RATE);
+        ctr0 += rej_eta(a0->coeffs + ctr0, N - ctr0, buf[0].coeffs, SHAKE256_RATE);
+        ctr1 += rej_eta(a1->coeffs + ctr1, N - ctr1, buf[1].coeffs, SHAKE256_RATE);
+        ctr2 += rej_eta(a2->coeffs + ctr2, N - ctr2, buf[2].coeffs, SHAKE256_RATE);
+        ctr3 += rej_eta(a3->coeffs + ctr3, N - ctr3, buf[3].coeffs, SHAKE256_RATE);
     }
 }
 
@@ -608,7 +594,7 @@ void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_gamma1_4x(poly *a0,
         poly *a1,
         poly *a2,
         poly *a3,
-        const uint8_t seed[48],
+        const uint8_t seed[64],
         uint16_t nonce0,
         uint16_t nonce1,
         uint16_t nonce2,
@@ -616,29 +602,28 @@ void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_gamma1_4x(poly *a0,
     ALIGNED_UINT8(POLY_UNIFORM_GAMMA1_NBLOCKS * STREAM256_BLOCKBYTES + 14) buf[4];
     keccakx4_state state;
     __m256i f;
-    __m128i g;
 
-    f = _mm256_loadu_si256((__m256i *)seed);
-    _mm256_store_si256(buf[0].vec, f);
-    _mm256_store_si256(buf[1].vec, f);
-    _mm256_store_si256(buf[2].vec, f);
-    _mm256_store_si256(buf[3].vec, f);
-    g = _mm_loadu_si128((__m128i *)&seed[32]);
-    _mm_store_si128((__m128i *)&buf[0].vec[1], g);
-    _mm_store_si128((__m128i *)&buf[1].vec[1], g);
-    _mm_store_si128((__m128i *)&buf[2].vec[1], g);
-    _mm_store_si128((__m128i *)&buf[3].vec[1], g);
-
-    buf[0].coeffs[CRHBYTES + 0] = nonce0;
-    buf[0].coeffs[CRHBYTES + 1] = nonce0 >> 8;
-    buf[1].coeffs[CRHBYTES + 0] = nonce1;
-    buf[1].coeffs[CRHBYTES + 1] = nonce1 >> 8;
-    buf[2].coeffs[CRHBYTES + 0] = nonce2;
-    buf[2].coeffs[CRHBYTES + 1] = nonce2 >> 8;
-    buf[3].coeffs[CRHBYTES + 0] = nonce3;
-    buf[3].coeffs[CRHBYTES + 1] = nonce3 >> 8;
-
-    PQCLEAN_DILITHIUM2_AVX2_shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, CRHBYTES + 2);
+    f = _mm256_loadu_si256((__m256i *)&seed[0]);
+    _mm256_store_si256(&buf[0].vec[0], f);
+    _mm256_store_si256(&buf[1].vec[0], f);
+    _mm256_store_si256(&buf[2].vec[0], f);
+    _mm256_store_si256(&buf[3].vec[0], f);
+    f = _mm256_loadu_si256((__m256i *)&seed[32]);
+    _mm256_store_si256(&buf[0].vec[1], f);
+    _mm256_store_si256(&buf[1].vec[1], f);
+    _mm256_store_si256(&buf[2].vec[1], f);
+    _mm256_store_si256(&buf[3].vec[1], f);
+
+    buf[0].coeffs[64] = nonce0;
+    buf[0].coeffs[65] = nonce0 >> 8;
+    buf[1].coeffs[64] = nonce1;
+    buf[1].coeffs[65] = nonce1 >> 8;
+    buf[2].coeffs[64] = nonce2;
+    buf[2].coeffs[65] = nonce2 >> 8;
+    buf[3].coeffs[64] = nonce3;
+    buf[3].coeffs[65] = nonce3 >> 8;
+
+    PQCLEAN_DILITHIUM2_AVX2_shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 66);
     PQCLEAN_DILITHIUM2_AVX2_shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, POLY_UNIFORM_GAMMA1_NBLOCKS, &state);
 
     PQCLEAN_DILITHIUM2_AVX2_polyz_unpack(a0, buf[0].coeffs);
@@ -962,7 +947,7 @@ void PQCLEAN_DILITHIUM2_AVX2_polyz_pack(uint8_t r[POLYZ_PACKEDBYTES], const poly
 * Arguments:   - poly *r: pointer to output polynomial
 *              - const uint8_t *a: byte array with bit-packed polynomial
 **************************************************/
-void PQCLEAN_DILITHIUM2_AVX2_polyz_unpack(poly *restrict r, const uint8_t a[POLYZ_PACKEDBYTES + 14]) {
+void PQCLEAN_DILITHIUM2_AVX2_polyz_unpack(poly *restrict r, const uint8_t *a) {
     unsigned int i;
     __m256i f;
     const __m256i shufbidx = _mm256_set_epi8(-1, 9, 8, 7, -1, 7, 6, 5, -1, 5, 4, 3, -1, 3, 2, 1,
@@ -996,7 +981,7 @@ void PQCLEAN_DILITHIUM2_AVX2_polyz_unpack(poly *restrict r, const uint8_t a[POLY
 *                            POLYW1_PACKEDBYTES bytes
 *              - const poly *a: pointer to input polynomial
 **************************************************/
-void PQCLEAN_DILITHIUM2_AVX2_polyw1_pack(uint8_t r[POLYW1_PACKEDBYTES + 8], const poly *restrict a) {
+void PQCLEAN_DILITHIUM2_AVX2_polyw1_pack(uint8_t *r, const poly *restrict a) {
     unsigned int i;
     __m256i f0, f1, f2, f3;
     const __m256i shift1 = _mm256_set1_epi16((64 << 8) + 1);

src/sign/dilithium/dilithium2/avx2/poly.h

@@ -9,7 +9,6 @@ typedef ALIGNED_INT32(N) poly;
 
 void PQCLEAN_DILITHIUM2_AVX2_poly_reduce(poly *a);
 void PQCLEAN_DILITHIUM2_AVX2_poly_caddq(poly *a);
-void PQCLEAN_DILITHIUM2_AVX2_poly_freeze(poly *a);
 
 void PQCLEAN_DILITHIUM2_AVX2_poly_add(poly *c, const poly *a, const poly *b);
 void PQCLEAN_DILITHIUM2_AVX2_poly_sub(poly *c, const poly *a, const poly *b);
@@ -28,8 +27,8 @@ void PQCLEAN_DILITHIUM2_AVX2_poly_use_hint(poly *b, const poly *a, const poly *h
 int PQCLEAN_DILITHIUM2_AVX2_poly_chknorm(const poly *a, int32_t B);
 void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_preinit(poly *a, stream128_state *state);
 void PQCLEAN_DILITHIUM2_AVX2_poly_uniform(poly *a, const uint8_t seed[SEEDBYTES], uint16_t nonce);
-void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_eta_preinit(poly *a, stream128_state *state);
-void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_eta(poly *a, const uint8_t seed[SEEDBYTES], uint16_t nonce);
+void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_eta_preinit(poly *a, stream256_state *state);
+void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_eta(poly *a, const uint8_t seed[CRHBYTES], uint16_t nonce);
 void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_gamma1_preinit(poly *a, stream256_state *state);
 void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_gamma1(poly *a, const uint8_t seed[CRHBYTES], uint16_t nonce);
 void PQCLEAN_DILITHIUM2_AVX2_poly_challenge(poly *c, const uint8_t seed[SEEDBYTES]);
@@ -47,7 +46,7 @@ void PQCLEAN_DILITHIUM2_AVX2_poly_uniform_eta_4x(poly *a0,
         poly *a1,
         poly *a2,
         poly *a3,
-        const uint8_t seed[SEEDBYTES],
+        const uint8_t seed[CRHBYTES],
         uint16_t nonce0,
         uint16_t nonce1,
         uint16_t nonce2,
@@ -72,8 +71,8 @@ void PQCLEAN_DILITHIUM2_AVX2_polyt0_pack(uint8_t r[POLYT0_PACKEDBYTES], const po
 void PQCLEAN_DILITHIUM2_AVX2_polyt0_unpack(poly *r, const uint8_t a[POLYT0_PACKEDBYTES]);
 
 void PQCLEAN_DILITHIUM2_AVX2_polyz_pack(uint8_t r[POLYZ_PACKEDBYTES], const poly *a);
-void PQCLEAN_DILITHIUM2_AVX2_polyz_unpack(poly *r, const uint8_t a[POLYZ_PACKEDBYTES + 14]);
+void PQCLEAN_DILITHIUM2_AVX2_polyz_unpack(poly *r, const uint8_t *a);
 
-void PQCLEAN_DILITHIUM2_AVX2_polyw1_pack(uint8_t r[POLYW1_PACKEDBYTES + 8], const poly *a);
+void PQCLEAN_DILITHIUM2_AVX2_polyw1_pack(uint8_t *r, const poly *a);
 
 #endif

src/sign/dilithium/dilithium2/avx2/polyvec.c

@@ -74,7 +74,7 @@ void PQCLEAN_DILITHIUM2_AVX2_polyvec_matrix_pointwise_montgomery(polyveck *t, co
 /************ Vectors of polynomials of length L **************/
 /**************************************************************/
 
-void PQCLEAN_DILITHIUM2_AVX2_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
+void PQCLEAN_DILITHIUM2_AVX2_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
     unsigned int i;
 
     for (i = 0; i < L; ++i) {
@@ -82,7 +82,7 @@ void PQCLEAN_DILITHIUM2_AVX2_polyvecl_uniform_eta(polyvecl *v, const uint8_t see
     }
 }
 
-void PQCLEAN_DILITHIUM2_AVX2_polyvecl_uniform_gamma1(polyvecl *v, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
+void PQCLEAN_DILITHIUM2_AVX2_polyvecl_uniform_gamma1(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
     unsigned int i;
 
     for (i = 0; i < L; ++i) {
@@ -98,22 +98,6 @@ void PQCLEAN_DILITHIUM2_AVX2_polyvecl_reduce(polyvecl *v) {
     }
 }
 
-/*************************************************
-* Name:        PQCLEAN_DILITHIUM2_AVX2_polyvecl_freeze
-*
-* Description: Reduce coefficients of polynomials in vector of length L
-*              to standard representatives.
-*
-* Arguments:   - polyvecl *v: pointer to input/output vector
-**************************************************/
-void PQCLEAN_DILITHIUM2_AVX2_polyvecl_freeze(polyvecl *v) {
-    unsigned int i;
-
-    for (i = 0; i < L; ++i) {
-        PQCLEAN_DILITHIUM2_AVX2_poly_freeze(&v->vec[i]);
-    }
-}
-
 /*************************************************
 * Name:        PQCLEAN_DILITHIUM2_AVX2_polyvecl_add
 *
@@ -207,7 +191,7 @@ int PQCLEAN_DILITHIUM2_AVX2_polyvecl_chknorm(const polyvecl *v, int32_t bound)
 /************ Vectors of polynomials of length K **************/
 /**************************************************************/
 
-void PQCLEAN_DILITHIUM2_AVX2_polyveck_uniform_eta(polyveck *v, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
+void PQCLEAN_DILITHIUM2_AVX2_polyveck_uniform_eta(polyveck *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
     unsigned int i;
 
     for (i = 0; i < K; ++i) {
@@ -247,22 +231,6 @@ void PQCLEAN_DILITHIUM2_AVX2_polyveck_caddq(polyveck *v) {
     }
 }
 
-/*************************************************
-* Name:        PQCLEAN_DILITHIUM2_AVX2_polyveck_freeze
-*
-* Description: Reduce coefficients of polynomials in vector of length K
-*              to standard representatives.
-*
-* Arguments:   - polyveck *v: pointer to input/output vector
-**************************************************/
-void PQCLEAN_DILITHIUM2_AVX2_polyveck_freeze(polyveck *v)  {
-    unsigned int i;
-
-    for (i = 0; i < K; ++i) {
-        PQCLEAN_DILITHIUM2_AVX2_poly_freeze(&v->vec[i]);
-    }
-}
-
 /*************************************************
 * Name:        PQCLEAN_DILITHIUM2_AVX2_polyveck_add
 *

src/sign/dilithium/dilithium2/avx2/polyvec.h

@@ -9,14 +9,12 @@ typedef struct {
     poly vec[L];
 } polyvecl;
 
-void PQCLEAN_DILITHIUM2_AVX2_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[SEEDBYTES], uint16_t nonce);
+void PQCLEAN_DILITHIUM2_AVX2_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
 
-void PQCLEAN_DILITHIUM2_AVX2_polyvecl_uniform_gamma1(polyvecl *v, const uint8_t seed[SEEDBYTES], uint16_t nonce);
+void PQCLEAN_DILITHIUM2_AVX2_polyvecl_uniform_gamma1(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
 
 void PQCLEAN_DILITHIUM2_AVX2_polyvecl_reduce(polyvecl *v);
 
-void PQCLEAN_DILITHIUM2_AVX2_polyvecl_freeze(polyvecl *v);
-
 void PQCLEAN_DILITHIUM2_AVX2_polyvecl_add(polyvecl *w, const polyvecl *u, const polyvecl *v);
 
 void PQCLEAN_DILITHIUM2_AVX2_polyvecl_ntt(polyvecl *v);
@@ -33,11 +31,10 @@ typedef struct {
     poly vec[K];
 } polyveck;
 
-void PQCLEAN_DILITHIUM2_AVX2_polyveck_uniform_eta(polyveck *v, const uint8_t seed[SEEDBYTES], uint16_t nonce);
+void PQCLEAN_DILITHIUM2_AVX2_polyveck_uniform_eta(polyveck *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
 
 void PQCLEAN_DILITHIUM2_AVX2_polyveck_reduce(polyveck *v);
 void PQCLEAN_DILITHIUM2_AVX2_polyveck_caddq(polyveck *v);
-void PQCLEAN_DILITHIUM2_AVX2_polyveck_freeze(polyveck *v);
 
 void PQCLEAN_DILITHIUM2_AVX2_polyveck_add(polyveck *w, const polyveck *u, const polyveck *v);
 void PQCLEAN_DILITHIUM2_AVX2_polyveck_sub(polyveck *w, const polyveck *u, const polyveck *v);

src/sign/dilithium/dilithium2/avx2/rejsample.h

@@ -7,13 +7,13 @@
 #define REJ_UNIFORM_NBLOCKS ((768+STREAM128_BLOCKBYTES-1)/STREAM128_BLOCKBYTES)
 #define REJ_UNIFORM_BUFLEN (REJ_UNIFORM_NBLOCKS*STREAM128_BLOCKBYTES)
 
-#define REJ_UNIFORM_ETA_NBLOCKS ((137+STREAM128_BLOCKBYTES-1)/STREAM128_BLOCKBYTES)
-#define REJ_UNIFORM_ETA_BUFLEN (REJ_UNIFORM_ETA_NBLOCKS*STREAM128_BLOCKBYTES)
+#define REJ_UNIFORM_ETA_NBLOCKS ((136+STREAM256_BLOCKBYTES-1)/STREAM256_BLOCKBYTES)
+#define REJ_UNIFORM_ETA_BUFLEN (REJ_UNIFORM_ETA_NBLOCKS*STREAM256_BLOCKBYTES)
 
 extern const uint8_t PQCLEAN_DILITHIUM2_AVX2_idxlut[256][8];
 
 unsigned int PQCLEAN_DILITHIUM2_AVX2_rej_uniform_avx(int32_t *r, const uint8_t buf[REJ_UNIFORM_BUFLEN + 8]);
 
-unsigned int PQCLEAN_DILITHIUM2_AVX2_rej_eta_avx(int32_t *r, const uint8_t buf[REJ_UNIFORM_BUFLEN]);
+unsigned int PQCLEAN_DILITHIUM2_AVX2_rej_eta_avx(int32_t *r, const uint8_t buf[REJ_UNIFORM_ETA_BUFLEN]);
 
 #endif

src/sign/dilithium/dilithium2/avx2/sign.c

@@ -45,7 +45,7 @@ static inline void polyvec_matrix_expand_row(polyvecl **row, polyvecl buf[2], co
 **************************************************/
 int PQCLEAN_DILITHIUM2_AVX2_crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
     unsigned int i;
-    uint8_t seedbuf[3 * SEEDBYTES];
+    uint8_t seedbuf[2 * SEEDBYTES + CRHBYTES];
     const uint8_t *rho, *rhoprime, *key;
     polyvecl rowbuf[2];
     polyvecl s1, *row = rowbuf;
@@ -54,10 +54,10 @@ int PQCLEAN_DILITHIUM2_AVX2_crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
 
     /* Get randomness for rho, rhoprime and key */
     randombytes(seedbuf, SEEDBYTES);
-    shake256(seedbuf, 3 * SEEDBYTES, seedbuf, SEEDBYTES);
+    shake256(seedbuf, 2 * SEEDBYTES + CRHBYTES, seedbuf, SEEDBYTES);
     rho = seedbuf;
-    rhoprime = seedbuf + SEEDBYTES;
-    key = seedbuf + 2 * SEEDBYTES;
+    rhoprime = rho + SEEDBYTES;
+    key = rhoprime + CRHBYTES;
 
     /* Store rho, key */
     memcpy(pk, rho, SEEDBYTES);
@@ -70,10 +70,10 @@ int PQCLEAN_DILITHIUM2_AVX2_crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
 
     /* Pack secret vectors */
     for (i = 0; i < L; i++) {
-        PQCLEAN_DILITHIUM2_AVX2_polyeta_pack(sk + 2 * SEEDBYTES + CRHBYTES + i * POLYETA_PACKEDBYTES, &s1.vec[i]);
+        PQCLEAN_DILITHIUM2_AVX2_polyeta_pack(sk + 3 * SEEDBYTES + i * POLYETA_PACKEDBYTES, &s1.vec[i]);
     }
     for (i = 0; i < K; i++) {
-        PQCLEAN_DILITHIUM2_AVX2_polyeta_pack(sk + 2 * SEEDBYTES + CRHBYTES + (L + i)*POLYETA_PACKEDBYTES, &s2.vec[i]);
+        PQCLEAN_DILITHIUM2_AVX2_polyeta_pack(sk + 3 * SEEDBYTES + (L + i)*POLYETA_PACKEDBYTES, &s2.vec[i]);
     }
 
     /* Transform s1 */
@@ -95,11 +95,11 @@ int PQCLEAN_DILITHIUM2_AVX2_crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
         PQCLEAN_DILITHIUM2_AVX2_poly_caddq(&t1);
         PQCLEAN_DILITHIUM2_AVX2_poly_power2round(&t1, &t0, &t1);
         PQCLEAN_DILITHIUM2_AVX2_polyt1_pack(pk + SEEDBYTES + i * POLYT1_PACKEDBYTES, &t1);
-        PQCLEAN_DILITHIUM2_AVX2_polyt0_pack(sk + 2 * SEEDBYTES + CRHBYTES + (L + K)*POLYETA_PACKEDBYTES + i * POLYT0_PACKEDBYTES, &t0);
+        PQCLEAN_DILITHIUM2_AVX2_polyt0_pack(sk + 3 * SEEDBYTES + (L + K)*POLYETA_PACKEDBYTES + i * POLYT0_PACKEDBYTES, &t0);
     }
 
-    /* Compute CRH(rho, t1) and store in secret key */
-    crh(sk + 2 * SEEDBYTES, pk, PQCLEAN_DILITHIUM2_AVX2_CRYPTO_PUBLICKEYBYTES);
+    /* Compute H(rho, t1) and store in secret key */
+    shake256(sk + 2 * SEEDBYTES, SEEDBYTES, pk, PQCLEAN_DILITHIUM2_AVX2_CRYPTO_PUBLICKEYBYTES);
 
     return 0;
 }
@@ -119,7 +119,7 @@ int PQCLEAN_DILITHIUM2_AVX2_crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
 **************************************************/
 int PQCLEAN_DILITHIUM2_AVX2_crypto_sign_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen, const uint8_t *sk) {
     unsigned int i, n, pos;
-    uint8_t seedbuf[2 * SEEDBYTES + 3 * CRHBYTES];
+    uint8_t seedbuf[3 * SEEDBYTES + 2 * CRHBYTES];
     uint8_t *rho, *tr, *key, *mu, *rhoprime;
     uint8_t hintbuf[N];
     uint8_t *hint = sig + SEEDBYTES + L * POLYZ_PACKEDBYTES;
@@ -135,20 +135,20 @@ int PQCLEAN_DILITHIUM2_AVX2_crypto_sign_signature(uint8_t *sig, size_t *siglen,
 
     rho = seedbuf;
     tr = rho + SEEDBYTES;
-    key = tr + CRHBYTES;
+    key = tr + SEEDBYTES;
     mu = key + SEEDBYTES;
     rhoprime = mu + CRHBYTES;
     PQCLEAN_DILITHIUM2_AVX2_unpack_sk(rho, tr, key, &t0, &s1, &s2, sk);
 
     /* Compute CRH(tr, msg) */
     shake256_inc_init(&state);
-    shake256_inc_absorb(&state, tr, CRHBYTES);
+    shake256_inc_absorb(&state, tr, SEEDBYTES);
     shake256_inc_absorb(&state, m, mlen);
     shake256_inc_finalize(&state);
     shake256_inc_squeeze(mu, CRHBYTES, &state);
     shake256_inc_ctx_release(&state);
 
-    crh(rhoprime, key, SEEDBYTES + CRHBYTES);
+    shake256(rhoprime, CRHBYTES, key, SEEDBYTES + CRHBYTES);
 
     /* Expand matrix and transform vectors */
     PQCLEAN_DILITHIUM2_AVX2_polyvec_matrix_expand(mat, rho);
@@ -293,10 +293,10 @@ int PQCLEAN_DILITHIUM2_AVX2_crypto_sign_verify(const uint8_t *sig, size_t siglen
         return -1;
     }
 
-    /* Compute CRH(CRH(rho, t1), msg) */
-    crh(mu, pk, PQCLEAN_DILITHIUM2_AVX2_CRYPTO_PUBLICKEYBYTES);
+    /* Compute CRH(H(rho, t1), msg) */
+    shake256(mu, SEEDBYTES, pk, PQCLEAN_DILITHIUM2_AVX2_CRYPTO_PUBLICKEYBYTES);
     shake256_inc_init(&state);
-    shake256_inc_absorb(&state, mu, CRHBYTES);
+    shake256_inc_absorb(&state, mu, SEEDBYTES);
     shake256_inc_absorb(&state, m, mlen);
     shake256_inc_finalize(&state);
     shake256_inc_squeeze(mu, CRHBYTES, &state);

src/sign/dilithium/dilithium2/avx2/symmetric.h

@@ -9,27 +9,18 @@
 typedef shake128incctx stream128_state;
 typedef shake256incctx stream256_state;
 
-void PQCLEAN_DILITHIUM2_AVX2_dilithium_shake128_stream_init(shake128incctx *state,
-        const uint8_t seed[SEEDBYTES],
-        uint16_t nonce);
+void PQCLEAN_DILITHIUM2_AVX2_dilithium_shake128_stream_init(shake128incctx *state, const uint8_t seed[SEEDBYTES], uint16_t nonce);
 
-void PQCLEAN_DILITHIUM2_AVX2_dilithium_shake256_stream_init(shake256incctx *state,
-        const uint8_t seed[CRHBYTES],
-        uint16_t nonce);
+void PQCLEAN_DILITHIUM2_AVX2_dilithium_shake256_stream_init(shake256incctx *state, const uint8_t seed[CRHBYTES], uint16_t nonce);
 
 #define STREAM128_BLOCKBYTES SHAKE128_RATE
 #define STREAM256_BLOCKBYTES SHAKE256_RATE
 
-#define crh(OUT, IN, INBYTES) shake256(OUT, CRHBYTES, IN, INBYTES)
-#define stream128_init(STATE, SEED, NONCE) \
-    PQCLEAN_DILITHIUM2_AVX2_dilithium_shake128_stream_init(STATE, SEED, NONCE)
-#define stream128_squeezeblocks(OUT, OUTBLOCKS, STATE) \
-    shake128_inc_squeeze(OUT, (OUTBLOCKS)*(SHAKE128_RATE), STATE)
+#define stream128_init(STATE, SEED, NONCE) PQCLEAN_DILITHIUM2_AVX2_dilithium_shake128_stream_init(STATE, SEED, NONCE)
+#define stream128_squeezeblocks(OUT, OUTBLOCKS, STATE) shake128_inc_squeeze(OUT, (OUTBLOCKS)*(SHAKE128_RATE), STATE)
 #define stream128_release(STATE) shake128_inc_ctx_release(STATE)
-#define stream256_init(STATE, SEED, NONCE) \
-    PQCLEAN_DILITHIUM2_AVX2_dilithium_shake256_stream_init(STATE, SEED, NONCE)
-#define stream256_squeezeblocks(OUT, OUTBLOCKS, STATE) \
-    shake256_inc_squeeze(OUT, (OUTBLOCKS)*(SHAKE256_RATE), STATE)
+#define stream256_init(STATE, SEED, NONCE) PQCLEAN_DILITHIUM2_AVX2_dilithium_shake256_stream_init(STATE, SEED, NONCE)
+#define stream256_squeezeblocks(OUT, OUTBLOCKS, STATE) shake256_inc_squeeze(OUT, (OUTBLOCKS)*(SHAKE256_RATE), STATE)
 #define stream256_release(STATE) shake256_inc_ctx_release(STATE)
 
 

src/sign/dilithium/dilithium2/clean/api.h

@@ -5,7 +5,7 @@
 #include <stdint.h>
 
 #define PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_PUBLICKEYBYTES 1312
-#define PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_SECRETKEYBYTES 2544
+#define PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_SECRETKEYBYTES 2528
 #define PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_BYTES 2420
 #define PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_ALGNAME "Dilithium2"
 

src/sign/dilithium/dilithium2/clean/packing.c

@@ -67,7 +67,7 @@ void PQCLEAN_DILITHIUM2_CLEAN_unpack_pk(uint8_t rho[SEEDBYTES],
 **************************************************/
 void PQCLEAN_DILITHIUM2_CLEAN_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_SECRETKEYBYTES],
                                       const uint8_t rho[SEEDBYTES],
-                                      const uint8_t tr[CRHBYTES],
+                                      const uint8_t tr[SEEDBYTES],
                                       const uint8_t key[SEEDBYTES],
                                       const polyveck *t0,
                                       const polyvecl *s1,
@@ -84,10 +84,10 @@ void PQCLEAN_DILITHIUM2_CLEAN_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM2_CLEAN_CRYPTO
     }
     sk += SEEDBYTES;
 
-    for (i = 0; i < CRHBYTES; ++i) {
+    for (i = 0; i < SEEDBYTES; ++i) {
         sk[i] = tr[i];
     }
-    sk += CRHBYTES;
+    sk += SEEDBYTES;
 
     for (i = 0; i < L; ++i) {
         PQCLEAN_DILITHIUM2_CLEAN_polyeta_pack(sk + i * POLYETA_PACKEDBYTES, &s1->vec[i]);
@@ -118,7 +118,7 @@ void PQCLEAN_DILITHIUM2_CLEAN_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM2_CLEAN_CRYPTO
 *              - uint8_t sk[]: byte array containing bit-packed sk
 **************************************************/
 void PQCLEAN_DILITHIUM2_CLEAN_unpack_sk(uint8_t rho[SEEDBYTES],
-                                        uint8_t tr[CRHBYTES],
+                                        uint8_t tr[SEEDBYTES],
                                         uint8_t key[SEEDBYTES],
                                         polyveck *t0,
                                         polyvecl *s1,
@@ -136,10 +136,10 @@ void PQCLEAN_DILITHIUM2_CLEAN_unpack_sk(uint8_t rho[SEEDBYTES],
     }
     sk += SEEDBYTES;
 
-    for (i = 0; i < CRHBYTES; ++i) {
+    for (i = 0; i < SEEDBYTES; ++i) {
         tr[i] = sk[i];
     }
-    sk += CRHBYTES;
+    sk += SEEDBYTES;
 
     for (i = 0; i < L; ++i) {
         PQCLEAN_DILITHIUM2_CLEAN_polyeta_unpack(&s1->vec[i], sk + i * POLYETA_PACKEDBYTES);

src/sign/dilithium/dilithium2/clean/packing.h

@@ -8,7 +8,7 @@ void PQCLEAN_DILITHIUM2_CLEAN_pack_pk(uint8_t pk[PQCLEAN_DILITHIUM2_CLEAN_CRYPTO
 
 void PQCLEAN_DILITHIUM2_CLEAN_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_SECRETKEYBYTES],
                                       const uint8_t rho[SEEDBYTES],
-                                      const uint8_t tr[CRHBYTES],
+                                      const uint8_t tr[SEEDBYTES],
                                       const uint8_t key[SEEDBYTES],
                                       const polyveck *t0,
                                       const polyvecl *s1,
@@ -19,7 +19,7 @@ void PQCLEAN_DILITHIUM2_CLEAN_pack_sig(uint8_t sig[PQCLEAN_DILITHIUM2_CLEAN_CRYP
 void PQCLEAN_DILITHIUM2_CLEAN_unpack_pk(uint8_t rho[SEEDBYTES], polyveck *t1, const uint8_t pk[PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_PUBLICKEYBYTES]);
 
 void PQCLEAN_DILITHIUM2_CLEAN_unpack_sk(uint8_t rho[SEEDBYTES],
-                                        uint8_t tr[CRHBYTES],
+                                        uint8_t tr[SEEDBYTES],
                                         uint8_t key[SEEDBYTES],
                                         polyveck *t0,
                                         polyvecl *s1,

src/sign/dilithium/dilithium2/clean/params.h

@@ -4,7 +4,7 @@
 
 
 #define SEEDBYTES 32
-#define CRHBYTES 48
+#define CRHBYTES 64
 #define N 256
 #define Q 8380417
 #define D 13
@@ -32,7 +32,7 @@
 #define POLYETA_PACKEDBYTES  96
 
 #define PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_PUBLICKEYBYTES (SEEDBYTES + K*POLYT1_PACKEDBYTES)
-#define PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_SECRETKEYBYTES (2*SEEDBYTES + CRHBYTES \
+#define PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_SECRETKEYBYTES (3*SEEDBYTES \
         + L*POLYETA_PACKEDBYTES \
         + K*POLYETA_PACKEDBYTES \
         + K*POLYT0_PACKEDBYTES)

src/sign/dilithium/dilithium2/clean/poly.c

@@ -47,25 +47,6 @@ void PQCLEAN_DILITHIUM2_CLEAN_poly_caddq(poly *a) {
     DBENCH_STOP(*tred);
 }
 
-/*************************************************
-* Name:        PQCLEAN_DILITHIUM2_CLEAN_poly_freeze
-*
-* Description: Inplace reduction of all coefficients of polynomial to
-*              standard representatives.
-*
-* Arguments:   - poly *a: pointer to input/output polynomial
-**************************************************/
-void PQCLEAN_DILITHIUM2_CLEAN_poly_freeze(poly *a) {
-    unsigned int i;
-    DBENCH_START();
-
-    for (i = 0; i < N; ++i) {
-        a->coeffs[i] = PQCLEAN_DILITHIUM2_CLEAN_freeze(a->coeffs[i]);
-    }
-
-    DBENCH_STOP(*tred);
-}
-
 /*************************************************
 * Name:        PQCLEAN_DILITHIUM2_CLEAN_poly_add
 *
@@ -438,28 +419,28 @@ static unsigned int rej_eta(int32_t *a,
 *              output stream from SHAKE256(seed|nonce) or AES256CTR(seed,nonce).
 *
 * Arguments:   - poly *a: pointer to output polynomial
-*              - const uint8_t seed[]: byte array with seed of length SEEDBYTES
+*              - const uint8_t seed[]: byte array with seed of length CRHBYTES
 *              - uint16_t nonce: 2-byte nonce
 **************************************************/
-#define POLY_UNIFORM_ETA_NBLOCKS ((136 + STREAM128_BLOCKBYTES - 1)/STREAM128_BLOCKBYTES)
+#define POLY_UNIFORM_ETA_NBLOCKS ((136 + STREAM256_BLOCKBYTES - 1)/STREAM256_BLOCKBYTES)
 void PQCLEAN_DILITHIUM2_CLEAN_poly_uniform_eta(poly *a,
-        const uint8_t seed[SEEDBYTES],
+        const uint8_t seed[CRHBYTES],
         uint16_t nonce) {
     unsigned int ctr;
-    unsigned int buflen = POLY_UNIFORM_ETA_NBLOCKS * STREAM128_BLOCKBYTES;
-    uint8_t buf[POLY_UNIFORM_ETA_NBLOCKS * STREAM128_BLOCKBYTES];
-    stream128_state state;
+    unsigned int buflen = POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES;
+    uint8_t buf[POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES];
+    stream256_state state;
 
-    stream128_init(&state, seed, nonce);
-    stream128_squeezeblocks(buf, POLY_UNIFORM_ETA_NBLOCKS, &state);
+    stream256_init(&state, seed, nonce);
+    stream256_squeezeblocks(buf, POLY_UNIFORM_ETA_NBLOCKS, &state);
 
     ctr = rej_eta(a->coeffs, N, buf, buflen);
 
     while (ctr < N) {
-        stream128_squeezeblocks(buf, 1, &state);
-        ctr += rej_eta(a->coeffs + ctr, N - ctr, buf, STREAM128_BLOCKBYTES);
+        stream256_squeezeblocks(buf, 1, &state);
+        ctr += rej_eta(a->coeffs + ctr, N - ctr, buf, STREAM256_BLOCKBYTES);
     }
-    stream128_release(&state);
+    stream256_release(&state);
 }
 
 /*************************************************

src/sign/dilithium/dilithium2/clean/poly.h

@@ -9,7 +9,6 @@ typedef struct {
 
 void PQCLEAN_DILITHIUM2_CLEAN_poly_reduce(poly *a);
 void PQCLEAN_DILITHIUM2_CLEAN_poly_caddq(poly *a);
-void PQCLEAN_DILITHIUM2_CLEAN_poly_freeze(poly *a);
 
 void PQCLEAN_DILITHIUM2_CLEAN_poly_add(poly *c, const poly *a, const poly *b);
 void PQCLEAN_DILITHIUM2_CLEAN_poly_sub(poly *c, const poly *a, const poly *b);
@@ -29,7 +28,7 @@ void PQCLEAN_DILITHIUM2_CLEAN_poly_uniform(poly *a,
         const uint8_t seed[SEEDBYTES],
         uint16_t nonce);
 void PQCLEAN_DILITHIUM2_CLEAN_poly_uniform_eta(poly *a,
-        const uint8_t seed[SEEDBYTES],
+        const uint8_t seed[CRHBYTES],
         uint16_t nonce);
 void PQCLEAN_DILITHIUM2_CLEAN_poly_uniform_gamma1(poly *a,
         const uint8_t seed[CRHBYTES],

src/sign/dilithium/dilithium2/clean/polyvec.c

@@ -36,7 +36,7 @@ void PQCLEAN_DILITHIUM2_CLEAN_polyvec_matrix_pointwise_montgomery(polyveck *t, c
 /************ Vectors of polynomials of length L **************/
 /**************************************************************/
 
-void PQCLEAN_DILITHIUM2_CLEAN_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
+void PQCLEAN_DILITHIUM2_CLEAN_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
     unsigned int i;
 
     for (i = 0; i < L; ++i) {
@@ -60,22 +60,6 @@ void PQCLEAN_DILITHIUM2_CLEAN_polyvecl_reduce(polyvecl *v) {
     }
 }
 
-/*************************************************
-* Name:        PQCLEAN_DILITHIUM2_CLEAN_polyvecl_freeze
-*
-* Description: Reduce coefficients of polynomials in vector of length L
-*              to standard representatives.
-*
-* Arguments:   - polyvecl *v: pointer to input/output vector
-**************************************************/
-void PQCLEAN_DILITHIUM2_CLEAN_polyvecl_freeze(polyvecl *v) {
-    unsigned int i;
-
-    for (i = 0; i < L; ++i) {
-        PQCLEAN_DILITHIUM2_CLEAN_poly_freeze(&v->vec[i]);
-    }
-}
-
 /*************************************************
 * Name:        PQCLEAN_DILITHIUM2_CLEAN_polyvecl_add
 *
@@ -178,7 +162,7 @@ int PQCLEAN_DILITHIUM2_CLEAN_polyvecl_chknorm(const polyvecl *v, int32_t bound)
 /************ Vectors of polynomials of length K **************/
 /**************************************************************/
 
-void PQCLEAN_DILITHIUM2_CLEAN_polyveck_uniform_eta(polyveck *v, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
+void PQCLEAN_DILITHIUM2_CLEAN_polyveck_uniform_eta(polyveck *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
     unsigned int i;
 
     for (i = 0; i < K; ++i) {
@@ -218,22 +202,6 @@ void PQCLEAN_DILITHIUM2_CLEAN_polyveck_caddq(polyveck *v) {
     }
 }
 
-/*************************************************
-* Name:        PQCLEAN_DILITHIUM2_CLEAN_polyveck_freeze
-*
-* Description: Reduce coefficients of polynomials in vector of length K
-*              to standard representatives.
-*
-* Arguments:   - polyveck *v: pointer to input/output vector
-**************************************************/
-void PQCLEAN_DILITHIUM2_CLEAN_polyveck_freeze(polyveck *v)  {
-    unsigned int i;
-
-    for (i = 0; i < K; ++i) {
-        PQCLEAN_DILITHIUM2_CLEAN_poly_freeze(&v->vec[i]);
-    }
-}
-
 /*************************************************
 * Name:        PQCLEAN_DILITHIUM2_CLEAN_polyveck_add
 *

src/sign/dilithium/dilithium2/clean/polyvec.h

@@ -9,14 +9,12 @@ typedef struct {
     poly vec[L];
 } polyvecl;
 
-void PQCLEAN_DILITHIUM2_CLEAN_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[SEEDBYTES], uint16_t nonce);
+void PQCLEAN_DILITHIUM2_CLEAN_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
 
 void PQCLEAN_DILITHIUM2_CLEAN_polyvecl_uniform_gamma1(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
 
 void PQCLEAN_DILITHIUM2_CLEAN_polyvecl_reduce(polyvecl *v);
 
-void PQCLEAN_DILITHIUM2_CLEAN_polyvecl_freeze(polyvecl *v);
-
 void PQCLEAN_DILITHIUM2_CLEAN_polyvecl_add(polyvecl *w, const polyvecl *u, const polyvecl *v);
 
 void PQCLEAN_DILITHIUM2_CLEAN_polyvecl_ntt(polyvecl *v);
@@ -36,11 +34,10 @@ typedef struct {
     poly vec[K];
 } polyveck;
 
-void PQCLEAN_DILITHIUM2_CLEAN_polyveck_uniform_eta(polyveck *v, const uint8_t seed[SEEDBYTES], uint16_t nonce);
+void PQCLEAN_DILITHIUM2_CLEAN_polyveck_uniform_eta(polyveck *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
 
 void PQCLEAN_DILITHIUM2_CLEAN_polyveck_reduce(polyveck *v);
 void PQCLEAN_DILITHIUM2_CLEAN_polyveck_caddq(polyveck *v);
-void PQCLEAN_DILITHIUM2_CLEAN_polyveck_freeze(polyveck *v);
 
 void PQCLEAN_DILITHIUM2_CLEAN_polyveck_add(polyveck *w, const polyveck *u, const polyveck *v);
 void PQCLEAN_DILITHIUM2_CLEAN_polyveck_sub(polyveck *w, const polyveck *u, const polyveck *v);

src/sign/dilithium/dilithium2/clean/sign.c

@@ -21,8 +21,8 @@
 * Returns 0 (success)
 **************************************************/
 int PQCLEAN_DILITHIUM2_CLEAN_crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
-    uint8_t seedbuf[3 * SEEDBYTES];
-    uint8_t tr[CRHBYTES];
+    uint8_t seedbuf[2 * SEEDBYTES + CRHBYTES];
+    uint8_t tr[SEEDBYTES];
     const uint8_t *rho, *rhoprime, *key;
     polyvecl mat[K];
     polyvecl s1, s1hat;
@@ -30,10 +30,10 @@ int PQCLEAN_DILITHIUM2_CLEAN_crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
 
     /* Get randomness for rho, rhoprime and key */
     randombytes(seedbuf, SEEDBYTES);
-    shake256(seedbuf, 3 * SEEDBYTES, seedbuf, SEEDBYTES);
+    shake256(seedbuf, 2 * SEEDBYTES + CRHBYTES, seedbuf, SEEDBYTES);
     rho = seedbuf;
-    rhoprime = seedbuf + SEEDBYTES;
-    key = seedbuf + 2 * SEEDBYTES;
+    rhoprime = rho + SEEDBYTES;
+    key = rhoprime + CRHBYTES;
 
     /* Expand matrix */
     PQCLEAN_DILITHIUM2_CLEAN_polyvec_matrix_expand(mat, rho);
@@ -57,8 +57,8 @@ int PQCLEAN_DILITHIUM2_CLEAN_crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
     PQCLEAN_DILITHIUM2_CLEAN_polyveck_power2round(&t1, &t0, &t1);
     PQCLEAN_DILITHIUM2_CLEAN_pack_pk(pk, rho, &t1);
 
-    /* Compute CRH(rho, t1) and write secret key */
-    crh(tr, pk, PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_PUBLICKEYBYTES);
+    /* Compute H(rho, t1) and write secret key */
+    shake256(tr, SEEDBYTES, pk, PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_PUBLICKEYBYTES);
     PQCLEAN_DILITHIUM2_CLEAN_pack_sk(sk, rho, tr, key, &t0, &s1, &s2);
 
     return 0;
@@ -83,7 +83,7 @@ int PQCLEAN_DILITHIUM2_CLEAN_crypto_sign_signature(uint8_t *sig,
         size_t mlen,
         const uint8_t *sk) {
     unsigned int n;
-    uint8_t seedbuf[2 * SEEDBYTES + 3 * CRHBYTES];
+    uint8_t seedbuf[3 * SEEDBYTES + 2 * CRHBYTES];
     uint8_t *rho, *tr, *key, *mu, *rhoprime;
     uint16_t nonce = 0;
     polyvecl mat[K], s1, y, z;
@@ -93,20 +93,20 @@ int PQCLEAN_DILITHIUM2_CLEAN_crypto_sign_signature(uint8_t *sig,
 
     rho = seedbuf;
     tr = rho + SEEDBYTES;
-    key = tr + CRHBYTES;
+    key = tr + SEEDBYTES;
     mu = key + SEEDBYTES;
     rhoprime = mu + CRHBYTES;
     PQCLEAN_DILITHIUM2_CLEAN_unpack_sk(rho, tr, key, &t0, &s1, &s2, sk);
 
     /* Compute CRH(tr, msg) */
     shake256_inc_init(&state);
-    shake256_inc_absorb(&state, tr, CRHBYTES);
+    shake256_inc_absorb(&state, tr, SEEDBYTES);
     shake256_inc_absorb(&state, m, mlen);
     shake256_inc_finalize(&state);
     shake256_inc_squeeze(mu, CRHBYTES, &state);
     shake256_inc_ctx_release(&state);
 
-    crh(rhoprime, key, SEEDBYTES + CRHBYTES);
+    shake256(rhoprime, CRHBYTES, key, SEEDBYTES + CRHBYTES);
 
     /* Expand matrix and transform vectors */
     PQCLEAN_DILITHIUM2_CLEAN_polyvec_matrix_expand(mat, rho);
@@ -250,10 +250,10 @@ int PQCLEAN_DILITHIUM2_CLEAN_crypto_sign_verify(const uint8_t *sig,
         return -1;
     }
 
-    /* Compute CRH(CRH(rho, t1), msg) */
-    crh(mu, pk, PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_PUBLICKEYBYTES);
+    /* Compute CRH(H(rho, t1), msg) */
+    shake256(mu, SEEDBYTES, pk, PQCLEAN_DILITHIUM2_CLEAN_CRYPTO_PUBLICKEYBYTES);
     shake256_inc_init(&state);
-    shake256_inc_absorb(&state, mu, CRHBYTES);
+    shake256_inc_absorb(&state, mu, SEEDBYTES);
     shake256_inc_absorb(&state, m, mlen);
     shake256_inc_finalize(&state);
     shake256_inc_squeeze(mu, CRHBYTES, &state);

src/sign/dilithium/dilithium2/clean/symmetric.h

@@ -20,7 +20,6 @@ void PQCLEAN_DILITHIUM2_CLEAN_dilithium_shake256_stream_init(shake256incctx *sta
 #define STREAM128_BLOCKBYTES SHAKE128_RATE
 #define STREAM256_BLOCKBYTES SHAKE256_RATE
 
-#define crh(OUT, IN, INBYTES) shake256(OUT, CRHBYTES, IN, INBYTES)
 #define stream128_init(STATE, SEED, NONCE) \
     PQCLEAN_DILITHIUM2_CLEAN_dilithium_shake128_stream_init(STATE, SEED, NONCE)
 #define stream128_squeezeblocks(OUT, OUTBLOCKS, STATE) \

src/sign/dilithium/dilithium3/aarch64/LICENSE

@@ -0,0 +1,121 @@
+Creative Commons Legal Code
+
+CC0 1.0 Universal
+
+    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+    HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without fear
+of later claims of infringement build upon, modify, incorporate in other
+works, reuse and redistribute as freely as possible in any form whatsoever
+and for any purposes, including without limitation commercial purposes.
+These owners may contribute to the Commons to promote the ideal of a free
+culture and the further production of creative, cultural and scientific
+works, or to gain reputation or greater distribution for their Work in
+part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under its
+terms, with knowledge of his or her Copyright and Related Rights in the
+Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be
+protected by copyright and related or neighboring rights ("Copyright and
+Related Rights"). Copyright and Related Rights include, but are not
+limited to, the following:
+
+  i. the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+ ii. moral rights retained by the original author(s) and/or performer(s);
+iii. publicity and privacy rights pertaining to a person's image or
+     likeness depicted in a Work;
+ iv. rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+  v. rights protecting the extraction, dissemination, use and reuse of data
+     in a Work;
+ vi. database rights (such as those arising under Directive 96/9/EC of the
+     European Parliament and of the Council of 11 March 1996 on the legal
+     protection of databases, and under any national implementation
+     thereof, including any amended or successor version of such
+     directive); and
+vii. other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention
+of, applicable law, Affirmer hereby overtly, fully, permanently,
+irrevocably and unconditionally waives, abandons, and surrenders all of
+Affirmer's Copyright and Related Rights and associated claims and causes
+of action, whether now known or unknown (including existing as well as
+future claims and causes of action), in the Work (i) in all territories
+worldwide, (ii) for the maximum duration provided by applicable law or
+treaty (including future time extensions), (iii) in any current or future
+medium and for any number of copies, and (iv) for any purpose whatsoever,
+including without limitation commercial, advertising or promotional
+purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+member of the public at large and to the detriment of Affirmer's heirs and
+successors, fully intending that such Waiver shall not be subject to
+revocation, rescission, cancellation, termination, or any other legal or
+equitable action to disrupt the quiet enjoyment of the Work by the public
+as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason
+be judged legally invalid or ineffective under applicable law, then the
+Waiver shall be preserved to the maximum extent permitted taking into
+account Affirmer's express Statement of Purpose. In addition, to the
+extent the Waiver is so judged Affirmer hereby grants to each affected
+person a royalty-free, non transferable, non sublicensable, non exclusive,
+irrevocable and unconditional license to exercise Affirmer's Copyright and
+Related Rights in the Work (i) in all territories worldwide, (ii) for the
+maximum duration provided by applicable law or treaty (including future
+time extensions), (iii) in any current or future medium and for any number
+of copies, and (iv) for any purpose whatsoever, including without
+limitation commercial, advertising or promotional purposes (the
+"License"). The License shall be deemed effective as of the date CC0 was
+applied by Affirmer to the Work. Should any part of the License for any
+reason be judged legally invalid or ineffective under applicable law, such
+partial invalidity or ineffectiveness shall not invalidate the remainder
+of the License, and in such case Affirmer hereby affirms that he or she
+will not (i) exercise any of his or her remaining Copyright and Related
+Rights in the Work or (ii) assert any associated claims and causes of
+action with respect to the Work, in either case contrary to Affirmer's
+express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
+    surrendered, licensed or otherwise affected by this document.
+ b. Affirmer offers the Work as-is and makes no representations or
+    warranties of any kind concerning the Work, express, implied,
+    statutory or otherwise, including without limitation warranties of
+    title, merchantability, fitness for a particular purpose, non
+    infringement, or the absence of latent or other defects, accuracy, or
+    the present or absence of errors, whether or not discoverable, all to
+    the greatest extent permissible under applicable law.
+ c. Affirmer disclaims responsibility for clearing rights of other persons
+    that may apply to the Work or any use thereof, including without
+    limitation any person's Copyright and Related Rights in the Work.
+    Further, Affirmer disclaims responsibility for obtaining any necessary
+    consents, permissions or other rights required for any use of the
+    Work.
+ d. Affirmer understands and acknowledges that Creative Commons is not a
+    party to this document and has no duty or obligation with respect to
+    this CC0 or use of the Work.

src/sign/dilithium/dilithium3/aarch64/Makefile

@@ -0,0 +1,23 @@
+# This Makefile can be used with GNU Make or BSD Make
+
+LIB=libdilithium3_aarch64.a
+HEADERS=api.h fips202x2.h macros_common.inc macros.inc NTT_params.h ntt.h packing.h params.h poly.h polyvec.h reduce.h rounding.h sign.h symmetric.h
+OBJECTS=fips202x2.o ntt.o packing.o poly.o polyvec.o reduce.o rounding.o sign.o symmetric-shake.o __asm_iNTT.o __asm_NTT.o __asm_poly.o
+
+
+CFLAGS=-O3 -Wall -Wextra -Wpedantic -Werror -Wmissing-prototypes -Wredundant-decls -std=c99 -I../../../common $(EXTRAFLAGS) -g
+
+all: $(LIB)
+
+%.o: %.c $(HEADERS)
+	$(CC) $(CFLAGS) -c -o $@ $<
+
+%.o: %.S $(HEADERS)
+	$(CC) $(CFLAGS) -c -o $@ $<
+
+$(LIB): $(OBJECTS) $(HEADERS)
+	$(AR) -r $@ $(OBJECTS)
+
+clean:
+	$(RM) $(OBJECTS)
+	$(RM) $(LIB)

src/sign/dilithium/dilithium3/aarch64/NTT_params.h

@@ -0,0 +1,56 @@
+#ifndef NTT_PARAMS_H
+#define NTT_PARAMS_H
+
+#define ARRAY_N 256
+
+#define NTT_N 256
+#define LOGNTT_N 8
+
+// root of unity: 1753
+
+
+// Q1
+#define Q1 8380417
+// omegaQ1 = 1753 mod Q1
+#define omegaQ1 1753
+// invomegaQ1 = omegaQ^{-1} mod Q1
+#define invomegaQ1 731434
+// R = 2^32 below
+// RmodQ1 = 2^32 mod^{+-} Q1
+#define RmodQ1 (-4186625)
+// Q1prime = Q1^{-1} mod^{+-} 2^32
+#define Q1prime 58728449
+// invNQ1 = NTT_N^{-1} mod Q1
+#define invNQ1 8347681
+
+// invNQ1R2modQ1 = -NTT_N^{-1} 2^32 2^32 mod^{+-} Q1 below
+#define invNQ1R2modQ1 (-41978)
+// invNQ1R2modQ1_prime = invNQ1R2modQ1 (Q1^{-1} mod^{+-} 2^32) mod^{+-} 2^32
+#define invNQ1R2modQ1_prime 8395782
+// invNQ1R2modQ1_prime_half = (invNQ1R2modQ1 / 2) (Q1^{-1} mod^{+-} 2^32) mod^{+-} 2^32
+#define invNQ1R2modQ1_prime_half 4197891
+// invNQ1R2modQ1_doubleprime = (invNQ1R2modQ1_prime Q1 - invNQ1R2modQ1) / 2^32
+#define invNQ1R2modQ1_doubleprime 16382
+
+// invNQ1_final_R2modQ1 = -invNQ1R2modQ1 invomegaQ1^{128} mod q
+#define invNQ1_final_R2modQ1 4404704
+// invNQ1_final_R2modQ1_prime = invNQ1_final_R2modQ1 (Q1^{-1} mod^{+-} 2^32) mod^{+-} 2^32
+#define invNQ1_final_R2modQ1_prime (-151046688)
+// invNQ1_final_R2modQ1_prime_half = (invNQ1_final_R2modQ1 / 2) (Q1^{-1} mod^{+-} 2^32) mod^{+-} 2^32
+#define invNQ1_final_R2modQ1_prime_half (-75523344)
+// invNQ1_final_R2modQ1_doubleprime = (invNQ1_final_R2modQ1_prime Q1 - invNQ1_final_R2modQ1) / 2^32
+#define invNQ1_final_R2modQ1_doubleprime (-294725)
+
+// RmodQ1_prime = -(RmodQ1 + Q1) Q1prime mod^{+-} 2^32
+#define RmodQ1_prime 512
+// RmodQ1_prime_half = ( -(RmodQ1 + Q1) / 2) Q1prime mod^{+-} 2^32
+#define RmodQ1_prime_half 256
+// RmodQ1_doubleprime = (RmodQ1_prime Q1 - RmodQ1_prime ) / 2^32
+#define RmodQ1_doubleprime 1
+
+#endif
+
+
+
+
+

src/sign/dilithium/dilithium3/aarch64/__asm_NTT.S

@@ -0,0 +1,274 @@
+
+#include "macros.inc"
+
+.align 2
+.global PQCLEAN_DILITHIUM3_AARCH64_asm_ntt_SIMD_top
+.global _PQCLEAN_DILITHIUM3_AARCH64_asm_ntt_SIMD_top
+#ifndef __clang__
+.type PQCLEAN_DILITHIUM3_AARCH64_asm_ntt_SIMD_top, %function
+#endif
+PQCLEAN_DILITHIUM3_AARCH64_asm_ntt_SIMD_top:
+_PQCLEAN_DILITHIUM3_AARCH64_asm_ntt_SIMD_top:
+
+    push_all
+    Q         .req w20
+    src0      .req x0
+    src1      .req x1
+    src2      .req x2
+    src3      .req x3
+    src4      .req x4
+    src5      .req x5
+    src6      .req x6
+    src7      .req x7
+    src8      .req x8
+    src9      .req x9
+    src10     .req x10
+    src11     .req x11
+    src12     .req x12
+    src13     .req x13
+    src14     .req x14
+    src15     .req x15
+    table     .req x28
+    counter   .req x19
+
+    ldr Q, [x2]
+
+    mov table, x1
+
+    add  src1, src0, #64
+    add  src2, src0, #128
+
+    add  src3, src0, #192
+    add  src4, src0, #256
+
+    add  src5, src0, #320
+    add  src6, src0, #384
+
+    add  src7, src0, #448
+    add  src8, src0, #512
+
+    add  src9, src0, #576
+    add src10, src0, #640
+
+    add src11, src0, #704
+    add src12, src0, #768
+
+    add src13, src0, #832
+    add src14, src0, #896
+
+    add src15, src0, #960
+
+    ld1 {v20.4S, v21.4S, v22.4S, v23.4S}, [table], #64
+    ld1 {v24.4S, v25.4S, v26.4S, v27.4S}, [table], #64
+
+    mov v20.S[0], Q
+
+    ld1 { v1.4S}, [ src1]
+    ld1 { v3.4S}, [ src3]
+    ld1 { v5.4S}, [ src5]
+    ld1 { v7.4S}, [ src7]
+    ld1 { v9.4S}, [ src9]
+    ld1 {v11.4S}, [src11]
+    ld1 {v13.4S}, [src13]
+    ld1 {v15.4S}, [src15]
+
+    ld1 { v0.4S}, [ src0]
+    ld1 { v2.4S}, [ src2]
+    ld1 { v4.4S}, [ src4]
+    ld1 { v6.4S}, [ src6]
+    ld1 { v8.4S}, [ src8]
+    ld1 {v10.4S}, [src10]
+    ld1 {v12.4S}, [src12]
+    ld1 {v14.4S}, [src14]
+
+    qq_butterfly_top  v1,  v3,  v5,  v7,  v9, v11, v13, v15, v16, v17, v18, v19, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_butterfly_mixed  v1,  v3,  v5,  v7,  v9, v11, v13, v15, v16, v17, v18, v19,  v0,  v2,  v4,  v6,  v8, v10, v12, v14, v28, v29, v30, v31, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_butterfly_mixed  v0,  v2,  v4,  v6,  v8, v10, v12, v14, v28, v29, v30, v31,  v1,  v3,  v9, v11,  v5,  v7, v13, v15, v16, v17, v18, v19, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3
+    qq_butterfly_mixed  v1,  v3,  v9, v11,  v5,  v7, v13, v15, v16, v17, v18, v19,  v0,  v2,  v8, v10,  v4,  v6, v12, v14, v28, v29, v30, v31, v20, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3
+    qq_butterfly_mixed  v0,  v2,  v8, v10,  v4,  v6, v12, v14, v28, v29, v30, v31,  v1,  v5,  v9, v13,  v3,  v7, v11, v15, v16, v17, v18, v19, v20, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3
+    qq_butterfly_mixed  v1,  v5,  v9, v13,  v3,  v7, v11, v15, v16, v17, v18, v19,  v0,  v4,  v8, v12,  v2,  v6, v10, v14, v28, v29, v30, v31, v20, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3
+    qq_butterfly_mixed  v0,  v4,  v8, v12,  v2,  v6, v10, v14, v28, v29, v30, v31,  v0,  v2,  v4,  v6,  v1,  v3,  v5,  v7, v16, v17, v18, v19, v20, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3, v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3
+    qq_butterfly_mixed  v0,  v2,  v4,  v6,  v1,  v3,  v5,  v7, v16, v17, v18, v19,  v8, v10, v12, v14,  v9, v11, v13, v15, v28, v29, v30, v31, v20,  v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3
+    qq_butterfly_bot  v8, v10, v12, v14,  v9, v11, v13, v15, v28, v29, v30, v31, v20, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3
+
+    mov counter, #3
+    _ntt_top_loop:
+
+    st1 { v1.4S}, [ src1], #16
+    ld1 { v1.4S}, [ src1]
+    st1 { v3.4S}, [ src3], #16
+    ld1 { v3.4S}, [ src3]
+    st1 { v5.4S}, [ src5], #16
+    ld1 { v5.4S}, [ src5]
+    st1 { v7.4S}, [ src7], #16
+    ld1 { v7.4S}, [ src7]
+    st1 { v9.4S}, [ src9], #16
+    ld1 { v9.4S}, [ src9]
+    st1 {v11.4S}, [src11], #16
+    ld1 {v11.4S}, [src11]
+    st1 {v13.4S}, [src13], #16
+    ld1 {v13.4S}, [src13]
+    st1 {v15.4S}, [src15], #16
+    ld1 {v15.4S}, [src15]
+
+    st1 { v0.4S}, [ src0], #16
+    ld1 { v0.4S}, [ src0]
+    st1 { v2.4S}, [ src2], #16
+    ld1 { v2.4S}, [ src2]
+    st1 { v4.4S}, [ src4], #16
+    ld1 { v4.4S}, [ src4]
+    st1 { v6.4S}, [ src6], #16
+    ld1 { v6.4S}, [ src6]
+    st1 { v8.4S}, [ src8], #16
+    ld1 { v8.4S}, [ src8]
+    st1 {v10.4S}, [src10], #16
+    ld1 {v10.4S}, [src10]
+    st1 {v12.4S}, [src12], #16
+    ld1 {v12.4S}, [src12]
+    st1 {v14.4S}, [src14], #16
+    ld1 {v14.4S}, [src14]
+
+    qq_butterfly_top  v1,  v3,  v5,  v7,  v9, v11, v13, v15, v16, v17, v18, v19, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_butterfly_mixed  v1,  v3,  v5,  v7,  v9, v11, v13, v15, v16, v17, v18, v19,  v0,  v2,  v4,  v6,  v8, v10, v12, v14, v28, v29, v30, v31, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_butterfly_mixed  v0,  v2,  v4,  v6,  v8, v10, v12, v14, v28, v29, v30, v31,  v1,  v3,  v9, v11,  v5,  v7, v13, v15, v16, v17, v18, v19, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3
+    qq_butterfly_mixed  v1,  v3,  v9, v11,  v5,  v7, v13, v15, v16, v17, v18, v19,  v0,  v2,  v8, v10,  v4,  v6, v12, v14, v28, v29, v30, v31, v20, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3
+    qq_butterfly_mixed  v0,  v2,  v8, v10,  v4,  v6, v12, v14, v28, v29, v30, v31,  v1,  v5,  v9, v13,  v3,  v7, v11, v15, v16, v17, v18, v19, v20, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3
+    qq_butterfly_mixed  v1,  v5,  v9, v13,  v3,  v7, v11, v15, v16, v17, v18, v19,  v0,  v4,  v8, v12,  v2,  v6, v10, v14, v28, v29, v30, v31, v20, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3
+    qq_butterfly_mixed  v0,  v4,  v8, v12,  v2,  v6, v10, v14, v28, v29, v30, v31,  v0,  v2,  v4,  v6,  v1,  v3,  v5,  v7, v16, v17, v18, v19, v20, v22, 0, 1, v22, 2, 3, v23, 0, 1, v23, 2, 3, v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3
+    qq_butterfly_mixed  v0,  v2,  v4,  v6,  v1,  v3,  v5,  v7, v16, v17, v18, v19,  v8, v10, v12, v14,  v9, v11, v13, v15, v28, v29, v30, v31, v20,  v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3
+    qq_butterfly_bot  v8, v10, v12, v14,  v9, v11, v13, v15, v28, v29, v30, v31, v20, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3
+
+    sub counter, counter, #1
+    cbnz counter, _ntt_top_loop
+
+    st1 { v1.4S}, [ src1], #16
+    st1 { v3.4S}, [ src3], #16
+    st1 { v5.4S}, [ src5], #16
+    st1 { v7.4S}, [ src7], #16
+    st1 { v9.4S}, [ src9], #16
+    st1 {v11.4S}, [src11], #16
+    st1 {v13.4S}, [src13], #16
+    st1 {v15.4S}, [src15], #16
+
+    st1 { v0.4S}, [ src0], #16
+    st1 { v2.4S}, [ src2], #16
+    st1 { v4.4S}, [ src4], #16
+    st1 { v6.4S}, [ src6], #16
+    st1 { v8.4S}, [ src8], #16
+    st1 {v10.4S}, [src10], #16
+    st1 {v12.4S}, [src12], #16
+    st1 {v14.4S}, [src14], #16
+
+    .unreq    Q
+    .unreq    src0
+    .unreq    src1
+    .unreq    src2
+    .unreq    src3
+    .unreq    src4
+    .unreq    src5
+    .unreq    src6
+    .unreq    src7
+    .unreq    src8
+    .unreq    src9
+    .unreq    src10
+    .unreq    src11
+    .unreq    src12
+    .unreq    src13
+    .unreq    src14
+    .unreq    src15
+    .unreq    table
+    .unreq    counter
+    pop_all
+
+    br lr
+
+.align 2
+.global PQCLEAN_DILITHIUM3_AARCH64_asm_ntt_SIMD_bot
+.global _PQCLEAN_DILITHIUM3_AARCH64_asm_ntt_SIMD_bot
+#ifndef __clang__
+.type PQCLEAN_DILITHIUM3_AARCH64_asm_ntt_SIMD_bot, %function
+#endif
+PQCLEAN_DILITHIUM3_AARCH64_asm_ntt_SIMD_bot:
+_PQCLEAN_DILITHIUM3_AARCH64_asm_ntt_SIMD_bot:
+
+    push_all
+    Q         .req w20
+    src0      .req x0
+    des0      .req x1
+    src1      .req x2
+    des1      .req x3
+    table0    .req x28
+    table1    .req x27
+    counter   .req x19
+
+    ldr Q, [x2]
+
+    add table0, x1, #128
+    add table1, table0, #1024
+
+    add src1, src0, #512
+
+    add des0, src0, #0
+    add des1, src0, #512
+
+    mov counter, #8
+    _ntt_bot_loop:
+
+    ld1 {  v0.4S,  v1.4S,  v2.4S,  v3.4S}, [src0], #64
+    ld1 { v16.4S, v17.4S, v18.4S, v19.4S}, [src1], #64
+
+    ld1 {  v4.4S,  v5.4S}, [table0], #32
+    ld2 {  v6.4S,  v7.4S}, [table0], #32
+    ld4 {  v8.4S,  v9.4S, v10.4S, v11.4S}, [table0], #64
+    ld1 { v20.4S, v21.4S}, [table1], #32
+    ld2 { v22.4S, v23.4S}, [table1], #32
+    ld4 { v24.4S, v25.4S, v26.4S, v27.4S}, [table1], #64
+
+    mov v4.S[0], Q
+
+    dq_butterfly_top  v0,  v1,  v2,  v3, v12, v13, v4,  v4, 2, 3,  v4, 2, 3
+    dq_butterfly_mixed  v0,  v1,  v2,  v3, v12, v13, v16, v17, v18, v19, v28, v29, v4,  v4, 2, 3,  v4, 2, 3, v20, 2, 3, v20, 2, 3
+    dq_butterfly_mixed v16, v17, v18, v19, v28, v29,  v0,  v2,  v1,  v3, v12, v13, v4, v20, 2, 3, v20, 2, 3,  v5, 0, 1,  v5, 2, 3
+    dq_butterfly_mixed  v0,  v2,  v1,  v3, v12, v13, v16, v18, v17, v19, v28, v29, v4,  v5, 0, 1,  v5, 2, 3, v21, 0, 1, v21, 2, 3
+    dq_butterfly_bot v16, v18, v17, v19, v28, v29, v4, v21, 0, 1, v21, 2, 3
+
+    trn_4x4  v0,  v1,  v2,  v3, v12, v13, v14, v15
+    trn_4x4 v16, v17, v18, v19, v28, v29, v30, v31
+
+    dq_butterfly_vec_top  v0,  v1,  v2,  v3, v12, v13, v4,  v6,  v7,  v6,  v7
+    dq_butterfly_vec_mixed  v0,  v1,  v2,  v3, v12, v13, v16, v17, v18, v19, v28, v29, v4,  v6,  v7,  v6,  v7, v22, v23, v22, v23
+    dq_butterfly_vec_mixed v16, v17, v18, v19, v28, v29,  v0,  v2,  v1,  v3, v12, v13, v4, v22, v23, v22, v23,  v8,  v9, v10, v11
+    dq_butterfly_vec_mixed  v0,  v2,  v1,  v3, v12, v13, v16, v18, v17, v19, v28, v29, v4,  v8,  v9, v10, v11, v24, v25, v26, v27
+    dq_butterfly_vec_bot v16, v18, v17, v19, v28, v29, v4, v24, v25, v26, v27
+
+    st4 {  v0.4S,  v1.4S,  v2.4S,  v3.4S}, [des0], #64
+    st4 { v16.4S, v17.4S, v18.4S, v19.4S}, [des1], #64
+
+    sub counter, counter, #1
+    cbnz counter, _ntt_bot_loop
+
+    .unreq    Q
+    .unreq    src0
+    .unreq    des0
+    .unreq    src1
+    .unreq    des1
+    .unreq    table0
+    .unreq    table1
+    .unreq    counter
+    pop_all
+
+    br lr
+
+
+
+
+
+
+
+
+
+
+
+
+
+

src/sign/dilithium/dilithium3/aarch64/__asm_iNTT.S

@@ -0,0 +1,509 @@
+
+#include "macros.inc"
+
+.align 2
+.global PQCLEAN_DILITHIUM3_AARCH64_asm_intt_SIMD_top
+.global _PQCLEAN_DILITHIUM3_AARCH64_asm_intt_SIMD_top
+#ifndef __clang__
+.type PQCLEAN_DILITHIUM3_AARCH64_asm_intt_SIMD_top, %function
+#endif
+PQCLEAN_DILITHIUM3_AARCH64_asm_intt_SIMD_top:
+_PQCLEAN_DILITHIUM3_AARCH64_asm_intt_SIMD_top:
+
+    push_all
+    Q         .req w20
+    Qhalf     .req w21
+    nQhalf    .req w22
+    invNR2ph  .req w24
+    invNR2dp  .req w25
+    invNWR2ph .req w26
+    invNWR2dp .req w27
+    src0      .req  x0
+    src1      .req  x1
+    src2      .req  x2
+    src3      .req  x3
+    src4      .req  x4
+    src5      .req  x5
+    src6      .req  x6
+    src7      .req  x7
+    src8      .req  x8
+    src9      .req  x9
+    src10     .req x10
+    src11     .req x11
+    src12     .req x12
+    src13     .req x13
+    src14     .req x14
+    src15     .req x15
+    table     .req x28
+    counter   .req x19
+
+    ldr Q, [x2, #0]
+    lsr Qhalf, Q, #1
+    neg nQhalf, Qhalf
+
+    ldr invNR2ph,  [x2, #16]
+    ldr invNR2dp,  [x2, #20]
+    ldr invNWR2ph, [x2, #24]
+    ldr invNWR2dp, [x2, #28]
+
+    mov table, x1
+
+    add  src1, src0, #64
+    add  src2, src0, #128
+
+    add  src3, src0, #192
+    add  src4, src0, #256
+
+    add  src5, src0, #320
+    add  src6, src0, #384
+
+    add  src7, src0, #448
+    add  src8, src0, #512
+
+    add  src9, src0, #576
+    add src10, src0, #640
+
+    add src11, src0, #704
+    add src12, src0, #768
+
+    add src13, src0, #832
+    add src14, src0, #896
+
+    add src15, src0, #960
+
+    ld1 {v20.4S, v21.4S, v22.4S, v23.4S}, [table], #64
+    ld1 {v24.4S, v25.4S, v26.4S, v27.4S}, [table], #64
+
+    mov v20.S[0], Q
+
+    ld1 { v0.4S}, [ src0]
+    ld1 { v1.4S}, [ src1]
+    ld1 { v2.4S}, [ src2]
+    ld1 { v3.4S}, [ src3]
+    ld1 { v4.4S}, [ src4]
+    ld1 { v5.4S}, [ src5]
+    ld1 { v6.4S}, [ src6]
+    ld1 { v7.4S}, [ src7]
+
+    ld1 { v8.4S}, [ src8]
+    ld1 { v9.4S}, [ src9]
+    ld1 {v10.4S}, [src10]
+    ld1 {v11.4S}, [src11]
+    ld1 {v12.4S}, [src12]
+    ld1 {v13.4S}, [src13]
+    ld1 {v14.4S}, [src14]
+    ld1 {v15.4S}, [src15]
+
+    qq_butterfly_bot  v0,  v2,  v4,  v6, v16, v17, v18, v19,  v1,  v3,  v5,  v7, v20, v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3
+    qq_butterfly_mixed_rev  v0,  v2,  v4,  v6, v16, v17, v18, v19,  v1,  v3,  v5,  v7,  v8, v10, v12, v14, v28, v29, v30, v31,  v9, v11, v13, v15, v20, v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3
+    qq_butterfly_mixed_rev  v8, v10, v12, v14, v28, v29, v30, v31,  v9, v11, v13, v15,  v0,  v1,  v4,  v5, v16, v17, v18, v19,  v2,  v3,  v6,  v7, v20, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3, v22, 0, 1, v22, 0, 1, v22, 2, 3, v22, 2, 3
+    qq_butterfly_mixed_rev  v0,  v1,  v4,  v5, v16, v17, v18, v19,  v2,  v3,  v6,  v7,  v8,  v9, v12, v13, v28, v29, v30, v31, v10, v11, v14, v15, v20, v22, 0, 1, v22, 0, 1, v22, 2, 3, v22, 2, 3, v23, 0, 1, v23, 0, 1, v23, 2, 3, v23, 2, 3
+    qq_butterfly_mixed_rev  v8,  v9, v12, v13, v28, v29, v30, v31, v10, v11, v14, v15,  v0,  v1,  v2,  v3, v16, v17, v18, v19,  v4,  v5,  v6,  v7, v20, v23, 0, 1, v23, 0, 1, v23, 2, 3, v23, 2, 3, v21, 0, 1, v21, 0, 1, v21, 0, 1, v21, 0, 1
+    qq_butterfly_mixed_rev  v0,  v1,  v2,  v3, v16, v17, v18, v19,  v4,  v5,  v6,  v7,  v8,  v9, v10, v11, v28, v29, v30, v31, v12, v13, v14, v15, v20, v21, 0, 1, v21, 0, 1, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3, v21, 2, 3, v21, 2, 3
+    qq_butterfly_top  v8,  v9, v10, v11, v28, v29, v30, v31, v12, v13, v14, v15, v20, v21, 2, 3, v21, 2, 3, v21, 2, 3, v21, 2, 3
+
+    mov v20.S[2], invNWR2ph
+    mov v20.S[3], invNWR2dp
+
+    qq_sub_add v16, v17, v18, v19, v28, v29, v30, v31,  v0,  v2,  v4,  v6,  v8, v10, v12, v14
+    qq_sub_add  v0,  v2,  v4,  v6,  v8, v10, v12, v14,  v1,  v3,  v5,  v7,  v9, v11, v13, v15
+
+    qq_montgomery_mul  v9, v11, v13, v15,  v8, v10, v12, v14, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_montgomery_mul  v8, v10, v12, v14, v28, v29, v30, v31, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+
+    mov v20.S[2], invNR2ph
+    mov v20.S[3], invNR2dp
+
+    qq_montgomery_mul  v1,  v3,  v5,  v7,  v0,  v2,  v4,  v6, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_montgomery_mul  v0,  v2,  v4,  v6, v16, v17, v18, v19, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+
+    dup v29.4S, Q
+    dup v30.4S, Qhalf
+    dup v31.4S, nQhalf
+
+    cmge v18.4S, v31.4S,  v0.4S
+    cmge v19.4S, v31.4S,  v1.4S
+    cmge v16.4S,  v0.4S, v30.4S
+    cmge v17.4S,  v1.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v0.4S, v16.4S, v29.4S
+    mla   v1.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v2.4S
+    cmge v19.4S, v31.4S,  v3.4S
+    cmge v16.4S,  v2.4S, v30.4S
+    cmge v17.4S,  v3.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v2.4S, v16.4S, v29.4S
+    mla   v3.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v4.4S
+    cmge v19.4S, v31.4S,  v5.4S
+    cmge v16.4S,  v4.4S, v30.4S
+    cmge v17.4S,  v5.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v4.4S, v16.4S, v29.4S
+    mla   v5.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v6.4S
+    cmge v19.4S, v31.4S,  v7.4S
+    cmge v16.4S,  v6.4S, v30.4S
+    cmge v17.4S,  v7.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v6.4S, v16.4S, v29.4S
+    mla   v7.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v8.4S
+    cmge v19.4S, v31.4S,  v9.4S
+    cmge v16.4S,  v8.4S, v30.4S
+    cmge v17.4S,  v9.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v8.4S, v16.4S, v29.4S
+    mla   v9.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S, v10.4S
+    cmge v19.4S, v31.4S, v11.4S
+    cmge v16.4S, v10.4S, v30.4S
+    cmge v17.4S, v11.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla  v10.4S, v16.4S, v29.4S
+    mla  v11.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S, v12.4S
+    cmge v19.4S, v31.4S, v13.4S
+    cmge v16.4S, v12.4S, v30.4S
+    cmge v17.4S, v13.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla  v12.4S, v16.4S, v29.4S
+    mla  v13.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S, v14.4S
+    cmge v19.4S, v31.4S, v15.4S
+    cmge v16.4S, v14.4S, v30.4S
+    cmge v17.4S, v15.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla  v14.4S, v16.4S, v29.4S
+    mla  v15.4S, v17.4S, v29.4S
+
+    mov counter, #3
+    _intt_top_loop:
+
+    st1 { v0.4S}, [ src0], #16
+    ld1 { v0.4S}, [ src0]
+    st1 { v1.4S}, [ src1], #16
+    ld1 { v1.4S}, [ src1]
+    st1 { v2.4S}, [ src2], #16
+    ld1 { v2.4S}, [ src2]
+    st1 { v3.4S}, [ src3], #16
+    ld1 { v3.4S}, [ src3]
+    st1 { v4.4S}, [ src4], #16
+    ld1 { v4.4S}, [ src4]
+    st1 { v5.4S}, [ src5], #16
+    ld1 { v5.4S}, [ src5]
+    st1 { v6.4S}, [ src6], #16
+    ld1 { v6.4S}, [ src6]
+    st1 { v7.4S}, [ src7], #16
+    ld1 { v7.4S}, [ src7]
+
+    st1 { v8.4S}, [ src8], #16
+    ld1 { v8.4S}, [ src8]
+    st1 { v9.4S}, [ src9], #16
+    ld1 { v9.4S}, [ src9]
+    st1 {v10.4S}, [src10], #16
+    ld1 {v10.4S}, [src10]
+    st1 {v11.4S}, [src11], #16
+    ld1 {v11.4S}, [src11]
+    st1 {v12.4S}, [src12], #16
+    ld1 {v12.4S}, [src12]
+    st1 {v13.4S}, [src13], #16
+    ld1 {v13.4S}, [src13]
+    st1 {v14.4S}, [src14], #16
+    ld1 {v14.4S}, [src14]
+    st1 {v15.4S}, [src15], #16
+    ld1 {v15.4S}, [src15]
+
+    qq_butterfly_bot  v0,  v2,  v4,  v6, v16, v17, v18, v19,  v1,  v3,  v5,  v7, v20, v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3
+    qq_butterfly_mixed_rev  v0,  v2,  v4,  v6, v16, v17, v18, v19,  v1,  v3,  v5,  v7,  v8, v10, v12, v14, v28, v29, v30, v31,  v9, v11, v13, v15, v20, v24, 0, 1, v24, 2, 3, v25, 0, 1, v25, 2, 3, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3
+    qq_butterfly_mixed_rev  v8, v10, v12, v14, v28, v29, v30, v31,  v9, v11, v13, v15,  v0,  v1,  v4,  v5, v16, v17, v18, v19,  v2,  v3,  v6,  v7, v20, v26, 0, 1, v26, 2, 3, v27, 0, 1, v27, 2, 3, v22, 0, 1, v22, 0, 1, v22, 2, 3, v22, 2, 3
+    qq_butterfly_mixed_rev  v0,  v1,  v4,  v5, v16, v17, v18, v19,  v2,  v3,  v6,  v7,  v8,  v9, v12, v13, v28, v29, v30, v31, v10, v11, v14, v15, v20, v22, 0, 1, v22, 0, 1, v22, 2, 3, v22, 2, 3, v23, 0, 1, v23, 0, 1, v23, 2, 3, v23, 2, 3
+    qq_butterfly_mixed_rev  v8,  v9, v12, v13, v28, v29, v30, v31, v10, v11, v14, v15,  v0,  v1,  v2,  v3, v16, v17, v18, v19,  v4,  v5,  v6,  v7, v20, v23, 0, 1, v23, 0, 1, v23, 2, 3, v23, 2, 3, v21, 0, 1, v21, 0, 1, v21, 0, 1, v21, 0, 1
+    qq_butterfly_mixed_rev  v0,  v1,  v2,  v3, v16, v17, v18, v19,  v4,  v5,  v6,  v7,  v8,  v9, v10, v11, v28, v29, v30, v31, v12, v13, v14, v15, v20, v21, 0, 1, v21, 0, 1, v21, 0, 1, v21, 0, 1, v21, 2, 3, v21, 2, 3, v21, 2, 3, v21, 2, 3
+    qq_butterfly_top  v8,  v9, v10, v11, v28, v29, v30, v31, v12, v13, v14, v15, v20, v21, 2, 3, v21, 2, 3, v21, 2, 3, v21, 2, 3
+
+    mov v20.S[2], invNWR2ph
+    mov v20.S[3], invNWR2dp
+
+    qq_sub_add v16, v17, v18, v19, v28, v29, v30, v31,  v0,  v2,  v4,  v6,  v8, v10, v12, v14
+    qq_sub_add  v0,  v2,  v4,  v6,  v8, v10, v12, v14,  v1,  v3,  v5,  v7,  v9, v11, v13, v15
+
+    qq_montgomery_mul  v9, v11, v13, v15,  v8, v10, v12, v14, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_montgomery_mul  v8, v10, v12, v14, v28, v29, v30, v31, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+
+    mov v20.S[2], invNR2ph
+    mov v20.S[3], invNR2dp
+
+    qq_montgomery_mul  v1,  v3,  v5,  v7,  v0,  v2,  v4,  v6, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+    qq_montgomery_mul  v0,  v2,  v4,  v6, v16, v17, v18, v19, v20, v20, 2, 3, v20, 2, 3, v20, 2, 3, v20, 2, 3
+
+    dup v29.4S, Q
+    dup v30.4S, Qhalf
+    dup v31.4S, nQhalf
+
+    cmge v18.4S, v31.4S,  v0.4S
+    cmge v19.4S, v31.4S,  v1.4S
+    cmge v16.4S,  v0.4S, v30.4S
+    cmge v17.4S,  v1.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v0.4S, v16.4S, v29.4S
+    mla   v1.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v2.4S
+    cmge v19.4S, v31.4S,  v3.4S
+    cmge v16.4S,  v2.4S, v30.4S
+    cmge v17.4S,  v3.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v2.4S, v16.4S, v29.4S
+    mla   v3.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v4.4S
+    cmge v19.4S, v31.4S,  v5.4S
+    cmge v16.4S,  v4.4S, v30.4S
+    cmge v17.4S,  v5.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v4.4S, v16.4S, v29.4S
+    mla   v5.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v6.4S
+    cmge v19.4S, v31.4S,  v7.4S
+    cmge v16.4S,  v6.4S, v30.4S
+    cmge v17.4S,  v7.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v6.4S, v16.4S, v29.4S
+    mla   v7.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S,  v8.4S
+    cmge v19.4S, v31.4S,  v9.4S
+    cmge v16.4S,  v8.4S, v30.4S
+    cmge v17.4S,  v9.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla   v8.4S, v16.4S, v29.4S
+    mla   v9.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S, v10.4S
+    cmge v19.4S, v31.4S, v11.4S
+    cmge v16.4S, v10.4S, v30.4S
+    cmge v17.4S, v11.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla  v10.4S, v16.4S, v29.4S
+    mla  v11.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S, v12.4S
+    cmge v19.4S, v31.4S, v13.4S
+    cmge v16.4S, v12.4S, v30.4S
+    cmge v17.4S, v13.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla  v12.4S, v16.4S, v29.4S
+    mla  v13.4S, v17.4S, v29.4S
+
+    cmge v18.4S, v31.4S, v14.4S
+    cmge v19.4S, v31.4S, v15.4S
+    cmge v16.4S, v14.4S, v30.4S
+    cmge v17.4S, v15.4S, v30.4S
+
+    sub  v16.4S, v16.4S, v18.4S
+    sub  v17.4S, v17.4S, v19.4S
+
+    mla  v14.4S, v16.4S, v29.4S
+    mla  v15.4S, v17.4S, v29.4S
+
+    sub counter, counter, #1
+    cbnz counter, _intt_top_loop
+
+    st1 { v0.4S}, [ src0], #16
+    st1 { v1.4S}, [ src1], #16
+    st1 { v2.4S}, [ src2], #16
+    st1 { v3.4S}, [ src3], #16
+    st1 { v4.4S}, [ src4], #16
+    st1 { v5.4S}, [ src5], #16
+    st1 { v6.4S}, [ src6], #16
+    st1 { v7.4S}, [ src7], #16
+
+    st1 { v8.4S}, [ src8], #16
+    st1 { v9.4S}, [ src9], #16
+    st1 {v10.4S}, [src10], #16
+    st1 {v11.4S}, [src11], #16
+    st1 {v12.4S}, [src12], #16
+    st1 {v13.4S}, [src13], #16
+    st1 {v14.4S}, [src14], #16
+    st1 {v15.4S}, [src15], #16
+
+    .unreq    Q
+    .unreq    Qhalf
+    .unreq    nQhalf
+    .unreq    invNR2ph
+    .unreq    invNR2dp
+    .unreq    invNWR2ph
+    .unreq    invNWR2dp
+    .unreq    src0
+    .unreq    src1
+    .unreq    src2
+    .unreq    src3
+    .unreq    src4
+    .unreq    src5
+    .unreq    src6
+    .unreq    src7
+    .unreq    src8
+    .unreq    src9
+    .unreq    src10
+    .unreq    src11
+    .unreq    src12
+    .unreq    src13
+    .unreq    src14
+    .unreq    src15
+    .unreq    table
+    .unreq    counter
+    pop_all
+
+    br lr
+
+.align 2
+.global PQCLEAN_DILITHIUM3_AARCH64_asm_intt_SIMD_bot
+.global _PQCLEAN_DILITHIUM3_AARCH64_asm_intt_SIMD_bot
+#ifndef __clang__
+.type PQCLEAN_DILITHIUM3_AARCH64_asm_intt_SIMD_bot, %function
+#endif
+PQCLEAN_DILITHIUM3_AARCH64_asm_intt_SIMD_bot:
+_PQCLEAN_DILITHIUM3_AARCH64_asm_intt_SIMD_bot:
+
+    push_all
+    Q         .req w20
+    RphRdp    .req x21
+    src0      .req x0
+    des0      .req x1
+    src1      .req x2
+    des1      .req x3
+    table0    .req x28
+    table1    .req x27
+    counter   .req x19
+
+    ldr Q, [x2]
+    ldr RphRdp, [x2, #8]
+
+    add table0, x1, #128
+    add table1, table0, #1024
+
+    add src1, src0, #512    
+
+    add des0, src0, #0
+    add des1, src0, #512
+
+    mov counter, #8
+    _intt_bot_loop:
+
+    ld4 {  v0.4S,  v1.4S,  v2.4S,  v3.4S}, [src0], #64
+    ld4 { v16.4S, v17.4S, v18.4S, v19.4S}, [src1], #64
+
+    ld1 {  v4.4S,  v5.4S}, [table0], #32
+    ld2 {  v6.4S,  v7.4S}, [table0], #32
+    ld4 {  v8.4S,  v9.4S, v10.4S, v11.4S}, [table0], #64
+    ld1 { v20.4S, v21.4S}, [table1], #32
+    ld2 { v22.4S, v23.4S}, [table1], #32
+    ld4 { v24.4S, v25.4S, v26.4S, v27.4S}, [table1], #64
+
+    mov v4.S[0], Q
+    mov v20.D[0], RphRdp
+
+    dq_butterfly_vec_bot  v0,  v2, v12, v13,  v1,  v3,  v4,  v8,  v9, v10, v11
+    dq_butterfly_vec_mixed_rev  v0,  v2, v12, v13,  v1,  v3, v16, v18, v28, v29, v17, v19,  v4,  v8,  v9, v10, v11, v24, v25, v26, v27
+    dq_butterfly_vec_mixed_rev v16, v18, v28, v29, v17, v19,  v0,  v1, v12, v13,  v2,  v3,  v4, v24, v25, v26, v27,  v6,  v7,  v6,  v7
+    dq_butterfly_vec_mixed_rev  v0,  v1, v12, v13,  v2,  v3, v16, v17, v28, v29, v18, v19,  v4,  v6,  v7,  v6,  v7, v22, v23, v22, v23
+    dq_butterfly_vec_top v16, v17, v28, v29, v18, v19,  v4, v22, v23, v22, v23
+
+    trn_4x4  v0,  v1,  v2,  v3, v12, v13, v14, v15
+    trn_4x4 v16, v17, v18, v19, v28, v29, v30, v31
+
+    dq_butterfly_bot  v0,  v2, v12, v13,  v1,  v3,  v4,  v5, 0, 1,  v5, 2, 3
+    dq_butterfly_mixed_rev  v0,  v2, v12, v13,  v1,  v3, v16, v18, v28, v29, v17, v19,  v4,  v5, 0, 1,  v5, 2, 3, v21, 0, 1, v21, 2, 3
+    dq_butterfly_mixed_rev v16, v18, v28, v29, v17, v19,  v0,  v1, v12, v13,  v2,  v3,  v4, v21, 0, 1, v21, 2, 3,  v4, 2, 3,  v4, 2, 3
+    dq_butterfly_mixed_rev  v0,  v1, v12, v13,  v2,  v3, v16, v17, v28, v29, v18, v19,  v4,  v4, 2, 3,  v4, 2, 3, v20, 2, 3, v20, 2, 3
+    dq_butterfly_top v16, v17, v28, v29, v18, v19,  v4, v20, 2, 3, v20, 2, 3
+
+    srshr v14.4S,  v0.4S, #23
+    srshr v15.4S,  v1.4S, #23
+    srshr v30.4S, v16.4S, #23
+    srshr v31.4S, v17.4S, #23
+
+    mls    v0.4S, v14.4S, v4.S[0]
+    mls    v1.4S, v15.4S, v4.S[0]
+    mls   v16.4S, v30.4S, v4.S[0]
+    mls   v17.4S, v31.4S, v4.S[0]
+
+    st1 {  v0.4S,  v1.4S,  v2.4S,  v3.4S}, [des0], #64
+    st1 { v16.4S, v17.4S, v18.4S, v19.4S}, [des1], #64
+
+    sub counter, counter, #1
+    cbnz counter, _intt_bot_loop
+
+    .unreq    Q
+    .unreq    RphRdp
+    .unreq    src0
+    .unreq    des0
+    .unreq    src1
+    .unreq    des1
+    .unreq    table0
+    .unreq    table1
+    .unreq    counter
+    pop_all
+
+    br lr
+
+
+
+
+
+

src/sign/dilithium/dilithium3/aarch64/api.h

@@ -0,0 +1,32 @@
+#ifndef PQCLEAN_DILITHIUM3_AARCH64_API_H
+#define PQCLEAN_DILITHIUM3_AARCH64_API_H
+
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define PQCLEAN_DILITHIUM3_AARCH64_CRYPTO_PUBLICKEYBYTES 1952
+#define PQCLEAN_DILITHIUM3_AARCH64_CRYPTO_SECRETKEYBYTES 4000
+#define PQCLEAN_DILITHIUM3_AARCH64_CRYPTO_BYTES 3293
+#define PQCLEAN_DILITHIUM3_AARCH64_CRYPTO_ALGNAME "Dilithium3"
+
+int PQCLEAN_DILITHIUM3_AARCH64_crypto_sign_keypair(uint8_t *pk, uint8_t *sk);
+
+int PQCLEAN_DILITHIUM3_AARCH64_crypto_sign_signature(
+    uint8_t *sig, size_t *siglen,
+    const uint8_t *m, size_t mlen, const uint8_t *sk);
+
+int PQCLEAN_DILITHIUM3_AARCH64_crypto_sign_verify(
+    const uint8_t *sig, size_t siglen,
+    const uint8_t *m, size_t mlen, const uint8_t *pk);
+
+int PQCLEAN_DILITHIUM3_AARCH64_crypto_sign(
+    uint8_t *sm, size_t *smlen,
+    const uint8_t *m, size_t mlen, const uint8_t *sk);
+
+int PQCLEAN_DILITHIUM3_AARCH64_crypto_sign_open(
+    uint8_t *m, size_t *mlen,
+    const uint8_t *sm, size_t smlen, const uint8_t *pk);
+
+
+#endif

src/sign/dilithium/dilithium3/aarch64/fips202x2.c

@@ -0,0 +1,646 @@
+#include "fips202x2.h"
+#include <arm_neon.h>
+#include <stddef.h>
+
+
+#define NROUNDS 24
+
+// Define NEON operation
+// c = load(ptr)
+#define vload(ptr) vld1q_u64(ptr);
+// ptr <= c;
+#define vstore(ptr, c) vst1q_u64(ptr, c);
+// c = a ^ b
+#define vxor(c, a, b) c = veorq_u64(a, b);
+// Rotate by n bit ((a << offset) ^ (a >> (64-offset)))
+#define vROL(out, a, offset)    \
+    (out) = vshlq_n_u64(a, offset); \
+    (out) = vsriq_n_u64(out, a, 64 - (offset));
+// Xor chain: out = a ^ b ^ c ^ d ^ e
+#define vXOR4(out, a, b, c, d, e) \
+    (out) = veorq_u64(a, b);          \
+    (out) = veorq_u64(out, c);        \
+    (out) = veorq_u64(out, d);        \
+    (out) = veorq_u64(out, e);
+// Not And c = ~a & b
+// #define vbic(c, a, b) c = vbicq_u64(b, a);
+// Xor Not And: out = a ^ ( (~b) & c)
+#define vXNA(out, a, b, c) \
+    (out) = vbicq_u64(c, b);   \
+    (out) = veorq_u64(out, a);
+// Rotate by 1 bit, then XOR: a ^ ROL(b): SHA1 instruction, not support
+#define vrxor(c, a, b) c = vrax1q_u64(a, b);
+// End Define
+
+/* Keccak round constants */
+static const uint64_t neon_KeccakF_RoundConstants[NROUNDS] = {
+    (uint64_t)0x0000000000000001ULL,
+    (uint64_t)0x0000000000008082ULL,
+    (uint64_t)0x800000000000808aULL,
+    (uint64_t)0x8000000080008000ULL,
+    (uint64_t)0x000000000000808bULL,
+    (uint64_t)0x0000000080000001ULL,
+    (uint64_t)0x8000000080008081ULL,
+    (uint64_t)0x8000000000008009ULL,
+    (uint64_t)0x000000000000008aULL,
+    (uint64_t)0x0000000000000088ULL,
+    (uint64_t)0x0000000080008009ULL,
+    (uint64_t)0x000000008000000aULL,
+    (uint64_t)0x000000008000808bULL,
+    (uint64_t)0x800000000000008bULL,
+    (uint64_t)0x8000000000008089ULL,
+    (uint64_t)0x8000000000008003ULL,
+    (uint64_t)0x8000000000008002ULL,
+    (uint64_t)0x8000000000000080ULL,
+    (uint64_t)0x000000000000800aULL,
+    (uint64_t)0x800000008000000aULL,
+    (uint64_t)0x8000000080008081ULL,
+    (uint64_t)0x8000000000008080ULL,
+    (uint64_t)0x0000000080000001ULL,
+    (uint64_t)0x8000000080008008ULL
+};
+
+/*************************************************
+* Name:        KeccakF1600_StatePermutex2
+*
+* Description: The Keccak F1600 Permutation
+*
+* Arguments:   - uint64_t *state: pointer to input/output Keccak state
+**************************************************/
+static inline
+void KeccakF1600_StatePermutex2(v128 state[25]) {
+    v128 Aba, Abe, Abi, Abo, Abu;
+    v128 Aga, Age, Agi, Ago, Agu;
+    v128 Aka, Ake, Aki, Ako, Aku;
+    v128 Ama, Ame, Ami, Amo, Amu;
+    v128 Asa, Ase, Asi, Aso, Asu;
+    v128 BCa, BCe, BCi, BCo, BCu; // tmp
+    v128 Da, De, Di, Do, Du;      // D
+    v128 Eba, Ebe, Ebi, Ebo, Ebu;
+    v128 Ega, Ege, Egi, Ego, Egu;
+    v128 Eka, Eke, Eki, Eko, Eku;
+    v128 Ema, Eme, Emi, Emo, Emu;
+    v128 Esa, Ese, Esi, Eso, Esu;
+
+    //copyFromState(A, state)
+    Aba = state[0];
+    Abe = state[1];
+    Abi = state[2];
+    Abo = state[3];
+    Abu = state[4];
+    Aga = state[5];
+    Age = state[6];
+    Agi = state[7];
+    Ago = state[8];
+    Agu = state[9];
+    Aka = state[10];
+    Ake = state[11];
+    Aki = state[12];
+    Ako = state[13];
+    Aku = state[14];
+    Ama = state[15];
+    Ame = state[16];
+    Ami = state[17];
+    Amo = state[18];
+    Amu = state[19];
+    Asa = state[20];
+    Ase = state[21];
+    Asi = state[22];
+    Aso = state[23];
+    Asu = state[24];
+
+    for (int round = 0; round < NROUNDS; round += 2) {
+        //    prepareTheta
+        vXOR4(BCa, Aba, Aga, Aka, Ama, Asa);
+        vXOR4(BCe, Abe, Age, Ake, Ame, Ase);
+        vXOR4(BCi, Abi, Agi, Aki, Ami, Asi);
+        vXOR4(BCo, Abo, Ago, Ako, Amo, Aso);
+        vXOR4(BCu, Abu, Agu, Aku, Amu, Asu);
+
+        //thetaRhoPiChiIotaPrepareTheta(round  , A, E)
+        vROL(Da, BCe, 1);
+        vxor(Da, BCu, Da);
+        vROL(De, BCi, 1);
+        vxor(De, BCa, De);
+        vROL(Di, BCo, 1);
+        vxor(Di, BCe, Di);
+        vROL(Do, BCu, 1);
+        vxor(Do, BCi, Do);
+        vROL(Du, BCa, 1);
+        vxor(Du, BCo, Du);
+
+        vxor(Aba, Aba, Da);
+        vxor(Age, Age, De);
+        vROL(BCe, Age, 44);
+        vxor(Aki, Aki, Di);
+        vROL(BCi, Aki, 43);
+        vxor(Amo, Amo, Do);
+        vROL(BCo, Amo, 21);
+        vxor(Asu, Asu, Du);
+        vROL(BCu, Asu, 14);
+        vXNA(Eba, Aba, BCe, BCi);
+        vxor(Eba, Eba, vdupq_n_u64(neon_KeccakF_RoundConstants[round]));
+        vXNA(Ebe, BCe, BCi, BCo);
+        vXNA(Ebi, BCi, BCo, BCu);
+        vXNA(Ebo, BCo, BCu, Aba);
+        vXNA(Ebu, BCu, Aba, BCe);
+
+        vxor(Abo, Abo, Do);
+        vROL(BCa, Abo, 28);
+        vxor(Agu, Agu, Du);
+        vROL(BCe, Agu, 20);
+        vxor(Aka, Aka, Da);
+        vROL(BCi, Aka, 3);
+        vxor(Ame, Ame, De);
+        vROL(BCo, Ame, 45);
+        vxor(Asi, Asi, Di);
+        vROL(BCu, Asi, 61);
+        vXNA(Ega, BCa, BCe, BCi);
+        vXNA(Ege, BCe, BCi, BCo);
+        vXNA(Egi, BCi, BCo, BCu);
+        vXNA(Ego, BCo, BCu, BCa);
+        vXNA(Egu, BCu, BCa, BCe);
+
+        vxor(Abe, Abe, De);
+        vROL(BCa, Abe, 1);
+        vxor(Agi, Agi, Di);
+        vROL(BCe, Agi, 6);
+        vxor(Ako, Ako, Do);
+        vROL(BCi, Ako, 25);
+        vxor(Amu, Amu, Du);
+        vROL(BCo, Amu, 8);
+        vxor(Asa, Asa, Da);
+        vROL(BCu, Asa, 18);
+        vXNA(Eka, BCa, BCe, BCi);
+        vXNA(Eke, BCe, BCi, BCo);
+        vXNA(Eki, BCi, BCo, BCu);
+        vXNA(Eko, BCo, BCu, BCa);
+        vXNA(Eku, BCu, BCa, BCe);
+
+        vxor(Abu, Abu, Du);
+        vROL(BCa, Abu, 27);
+        vxor(Aga, Aga, Da);
+        vROL(BCe, Aga, 36);
+        vxor(Ake, Ake, De);
+        vROL(BCi, Ake, 10);
+        vxor(Ami, Ami, Di);
+        vROL(BCo, Ami, 15);
+        vxor(Aso, Aso, Do);
+        vROL(BCu, Aso, 56);
+        vXNA(Ema, BCa, BCe, BCi);
+        vXNA(Eme, BCe, BCi, BCo);
+        vXNA(Emi, BCi, BCo, BCu);
+        vXNA(Emo, BCo, BCu, BCa);
+        vXNA(Emu, BCu, BCa, BCe);
+
+        vxor(Abi, Abi, Di);
+        vROL(BCa, Abi, 62);
+        vxor(Ago, Ago, Do);
+        vROL(BCe, Ago, 55);
+        vxor(Aku, Aku, Du);
+        vROL(BCi, Aku, 39);
+        vxor(Ama, Ama, Da);
+        vROL(BCo, Ama, 41);
+        vxor(Ase, Ase, De);
+        vROL(BCu, Ase, 2);
+        vXNA(Esa, BCa, BCe, BCi);
+        vXNA(Ese, BCe, BCi, BCo);
+        vXNA(Esi, BCi, BCo, BCu);
+        vXNA(Eso, BCo, BCu, BCa);
+        vXNA(Esu, BCu, BCa, BCe);
+
+        // Next Round
+
+        //    prepareTheta
+        vXOR4(BCa, Eba, Ega, Eka, Ema, Esa);
+        vXOR4(BCe, Ebe, Ege, Eke, Eme, Ese);
+        vXOR4(BCi, Ebi, Egi, Eki, Emi, Esi);
+        vXOR4(BCo, Ebo, Ego, Eko, Emo, Eso);
+        vXOR4(BCu, Ebu, Egu, Eku, Emu, Esu);
+
+        //thetaRhoPiChiIotaPrepareTheta(round+1, E, A)
+        vROL(Da, BCe, 1);
+        vxor(Da, BCu, Da);
+        vROL(De, BCi, 1);
+        vxor(De, BCa, De);
+        vROL(Di, BCo, 1);
+        vxor(Di, BCe, Di);
+        vROL(Do, BCu, 1);
+        vxor(Do, BCi, Do);
+        vROL(Du, BCa, 1);
+        vxor(Du, BCo, Du);
+
+        vxor(Eba, Eba, Da);
+        vxor(Ege, Ege, De);
+        vROL(BCe, Ege, 44);
+        vxor(Eki, Eki, Di);
+        vROL(BCi, Eki, 43);
+        vxor(Emo, Emo, Do);
+        vROL(BCo, Emo, 21);
+        vxor(Esu, Esu, Du);
+        vROL(BCu, Esu, 14);
+        vXNA(Aba, Eba, BCe, BCi);
+        vxor(Aba, Aba, vdupq_n_u64(neon_KeccakF_RoundConstants[round + 1]));
+        vXNA(Abe, BCe, BCi, BCo);
+        vXNA(Abi, BCi, BCo, BCu);
+        vXNA(Abo, BCo, BCu, Eba);
+        vXNA(Abu, BCu, Eba, BCe);
+
+        vxor(Ebo, Ebo, Do);
+        vROL(BCa, Ebo, 28);
+        vxor(Egu, Egu, Du);
+        vROL(BCe, Egu, 20);
+        vxor(Eka, Eka, Da);
+        vROL(BCi, Eka, 3);
+        vxor(Eme, Eme, De);
+        vROL(BCo, Eme, 45);
+        vxor(Esi, Esi, Di);
+        vROL(BCu, Esi, 61);
+        vXNA(Aga, BCa, BCe, BCi);
+        vXNA(Age, BCe, BCi, BCo);
+        vXNA(Agi, BCi, BCo, BCu);
+        vXNA(Ago, BCo, BCu, BCa);
+        vXNA(Agu, BCu, BCa, BCe);
+
+        vxor(Ebe, Ebe, De);
+        vROL(BCa, Ebe, 1);
+        vxor(Egi, Egi, Di);
+        vROL(BCe, Egi, 6);
+        vxor(Eko, Eko, Do);
+        vROL(BCi, Eko, 25);
+        vxor(Emu, Emu, Du);
+        vROL(BCo, Emu, 8);
+        vxor(Esa, Esa, Da);
+        vROL(BCu, Esa, 18);
+        vXNA(Aka, BCa, BCe, BCi);
+        vXNA(Ake, BCe, BCi, BCo);
+        vXNA(Aki, BCi, BCo, BCu);
+        vXNA(Ako, BCo, BCu, BCa);
+        vXNA(Aku, BCu, BCa, BCe);
+
+        vxor(Ebu, Ebu, Du);
+        vROL(BCa, Ebu, 27);
+        vxor(Ega, Ega, Da);
+        vROL(BCe, Ega, 36);
+        vxor(Eke, Eke, De);
+        vROL(BCi, Eke, 10);
+        vxor(Emi, Emi, Di);
+        vROL(BCo, Emi, 15);
+        vxor(Eso, Eso, Do);
+        vROL(BCu, Eso, 56);
+        vXNA(Ama, BCa, BCe, BCi);
+        vXNA(Ame, BCe, BCi, BCo);
+        vXNA(Ami, BCi, BCo, BCu);
+        vXNA(Amo, BCo, BCu, BCa);
+        vXNA(Amu, BCu, BCa, BCe);
+
+        vxor(Ebi, Ebi, Di);
+        vROL(BCa, Ebi, 62);
+        vxor(Ego, Ego, Do);
+        vROL(BCe, Ego, 55);
+        vxor(Eku, Eku, Du);
+        vROL(BCi, Eku, 39);
+        vxor(Ema, Ema, Da);
+        vROL(BCo, Ema, 41);
+        vxor(Ese, Ese, De);
+        vROL(BCu, Ese, 2);
+        vXNA(Asa, BCa, BCe, BCi);
+        vXNA(Ase, BCe, BCi, BCo);
+        vXNA(Asi, BCi, BCo, BCu);
+        vXNA(Aso, BCo, BCu, BCa);
+        vXNA(Asu, BCu, BCa, BCe);
+    }
+
+    state[0] = Aba;
+    state[1] = Abe;
+    state[2] = Abi;
+    state[3] = Abo;
+    state[4] = Abu;
+    state[5] = Aga;
+    state[6] = Age;
+    state[7] = Agi;
+    state[8] = Ago;
+    state[9] = Agu;
+    state[10] = Aka;
+    state[11] = Ake;
+    state[12] = Aki;
+    state[13] = Ako;
+    state[14] = Aku;
+    state[15] = Ama;
+    state[16] = Ame;
+    state[17] = Ami;
+    state[18] = Amo;
+    state[19] = Amu;
+    state[20] = Asa;
+    state[21] = Ase;
+    state[22] = Asi;
+    state[23] = Aso;
+    state[24] = Asu;
+}
+
+/*************************************************
+* Name:        keccakx2_absorb
+*
+* Description: Absorb step of Keccak;
+*              non-incremental, starts by zeroeing the state.
+*
+* Arguments:   - uint64_t *s: pointer to (uninitialized) output Keccak state
+*              - unsigned int r: rate in bytes (e.g., 168 for SHAKE128)
+*              - const uint8_t *m: pointer to input to be absorbed into s
+*              - size_t mlen: length of input in bytes
+*              - uint8_t p: domain-separation byte for different
+*                           Keccak-derived functions
+**************************************************/
+static
+void keccakx2_absorb(v128 s[25],
+                     unsigned int r,
+                     const uint8_t *in0,
+                     const uint8_t *in1,
+                     size_t inlen,
+                     uint8_t p) {
+    size_t i, pos = 0;
+
+    // Declare SIMD registers
+    v128 tmp, mask;
+    uint64x1_t a, b;
+    uint64x2_t a1, b1, atmp1, btmp1;
+    uint64x2x2_t a2, b2, atmp2, btmp2;
+    // End
+
+    for (i = 0; i < 25; ++i) {
+        s[i] = vdupq_n_u64(0);
+    }
+
+    // Load in0[i] to register, then in1[i] to register, exchange them
+    while (inlen >= r) {
+        for (i = 0; i < r / 8 - 1; i += 4) {
+            a2 = vld1q_u64_x2((uint64_t *)&in0[pos]);
+            b2 = vld1q_u64_x2((uint64_t *)&in1[pos]);
+            // BD = zip1(AB and CD)
+            atmp2.val[0] = vzip1q_u64(a2.val[0], b2.val[0]);
+            atmp2.val[1] = vzip1q_u64(a2.val[1], b2.val[1]);
+            // AC = zip2(AB and CD)
+            btmp2.val[0] = vzip2q_u64(a2.val[0], b2.val[0]);
+            btmp2.val[1] = vzip2q_u64(a2.val[1], b2.val[1]);
+
+            vxor(s[i + 0], s[i + 0], atmp2.val[0]);
+            vxor(s[i + 1], s[i + 1], btmp2.val[0]);
+            vxor(s[i + 2], s[i + 2], atmp2.val[1]);
+            vxor(s[i + 3], s[i + 3], btmp2.val[1]);
+
+            pos += 8 * 2 * 2;
+        }
+        // Last iteration
+        i = r / 8 - 1;
+        a = vld1_u64((uint64_t *)&in0[pos]);
+        b = vld1_u64((uint64_t *)&in1[pos]);
+        tmp = vcombine_u64(a, b);
+        vxor(s[i], s[i], tmp);
+        pos += 8;
+
+        KeccakF1600_StatePermutex2(s);
+        inlen -= r;
+    }
+
+    i = 0;
+    while (inlen >= 16) {
+        a1 = vld1q_u64((uint64_t *)&in0[pos]);
+        b1 = vld1q_u64((uint64_t *)&in1[pos]);
+        // BD = zip1(AB and CD)
+        atmp1 = vzip1q_u64(a1, b1);
+        // AC = zip2(AB and CD)
+        btmp1 = vzip2q_u64(a1, b1);
+
+        vxor(s[i + 0], s[i + 0], atmp1);
+        vxor(s[i + 1], s[i + 1], btmp1);
+
+        i += 2;
+        pos += 8 * 2;
+        inlen -= 8 * 2;
+    }
+
+    if (inlen >= 8) {
+        a = vld1_u64((uint64_t *)&in0[pos]);
+        b = vld1_u64((uint64_t *)&in1[pos]);
+        tmp = vcombine_u64(a, b);
+        vxor(s[i], s[i], tmp);
+
+        i++;
+        pos += 8;
+        inlen -= 8;
+    }
+
+    if (inlen) {
+        a = vld1_u64((uint64_t *)&in0[pos]);
+        b = vld1_u64((uint64_t *)&in1[pos]);
+        tmp = vcombine_u64(a, b);
+        mask = vdupq_n_u64((1ULL << (8 * inlen)) - 1);
+        tmp = vandq_u64(tmp, mask);
+        vxor(s[i], s[i], tmp);
+    }
+
+    tmp = vdupq_n_u64((uint64_t)p << (8 * inlen));
+    vxor(s[i], s[i], tmp);
+
+    mask = vdupq_n_u64(1ULL << 63);
+    vxor(s[r / 8 - 1], s[r / 8 - 1], mask);
+}
+
+/*************************************************
+* Name:        keccak_squeezeblocks
+*
+* Description: Squeeze step of Keccak. Squeezes full blocks of r bytes each.
+*              Modifies the state. Can be called multiple times to keep
+*              squeezing, i.e., is incremental.
+*
+* Arguments:   - uint8_t *out: pointer to output blocks
+*              - size_t nblocks: number of blocks to be squeezed (written to h)
+*              - unsigned int r: rate in bytes (e.g., 168 for SHAKE128)
+*              - uint64_t *s: pointer to input/output Keccak state
+**************************************************/
+static
+void keccakx2_squeezeblocks(uint8_t *out0,
+                            uint8_t *out1,
+                            size_t nblocks,
+                            unsigned int r,
+                            v128 s[25]) {
+    unsigned int i;
+
+    uint64x1_t a, b;
+    uint64x2x2_t a2, b2;
+
+    while (nblocks > 0) {
+        KeccakF1600_StatePermutex2(s);
+
+        for (i = 0; i < r / 8 - 1; i += 4) {
+            a2.val[0] = vuzp1q_u64(s[i], s[i + 1]);
+            b2.val[0] = vuzp2q_u64(s[i], s[i + 1]);
+            a2.val[1] = vuzp1q_u64(s[i + 2], s[i + 3]);
+            b2.val[1] = vuzp2q_u64(s[i + 2], s[i + 3]);
+            vst1q_u64_x2((uint64_t *)out0, a2);
+            vst1q_u64_x2((uint64_t *)out1, b2);
+
+            out0 += 32;
+            out1 += 32;
+        }
+
+        i = r / 8 - 1;
+        // Last iteration
+        a = vget_low_u64(s[i]);
+        b = vget_high_u64(s[i]);
+        vst1_u64((uint64_t *)out0, a);
+        vst1_u64((uint64_t *)out1, b);
+
+        out0 += 8;
+        out1 += 8;
+
+        --nblocks;
+    }
+}
+
+/*************************************************
+* Name:        shake128x2_absorb
+*
+* Description: Absorb step of the SHAKE128 XOF.
+*              non-incremental, starts by zeroeing the state.
+*
+* Arguments:   - keccakx2_state *state: pointer to (uninitialized) output
+*                                     Keccak state
+*              - const uint8_t *in:   pointer to input to be absorbed into s
+*              - size_t inlen:        length of input in bytes
+**************************************************/
+void shake128x2_absorb(keccakx2_state *state,
+                       const uint8_t *in0,
+                       const uint8_t *in1,
+                       size_t inlen) {
+    keccakx2_absorb(state->s, SHAKE128_RATE, in0, in1, inlen, 0x1F);
+}
+
+/*************************************************
+* Name:        shake128_squeezeblocks
+*
+* Description: Squeeze step of SHAKE128 XOF. Squeezes full blocks of
+*              SHAKE128_RATE bytes each. Modifies the state. Can be called
+*              multiple times to keep squeezing, i.e., is incremental.
+*
+* Arguments:   - uint8_t *out:    pointer to output blocks
+*              - size_t nblocks:  number of blocks to be squeezed
+*                                 (written to output)
+*              - keccakx2_state *s: pointer to input/output Keccak state
+**************************************************/
+void shake128x2_squeezeblocks(uint8_t *out0,
+                              uint8_t *out1,
+                              size_t nblocks,
+                              keccakx2_state *state) {
+    keccakx2_squeezeblocks(out0, out1, nblocks, SHAKE128_RATE, state->s);
+}
+
+/*************************************************
+* Name:        shake256_absorb
+*
+* Description: Absorb step of the SHAKE256 XOF.
+*              non-incremental, starts by zeroeing the state.
+*
+* Arguments:   - keccakx2_state *s:   pointer to (uninitialized) output Keccak state
+*              - const uint8_t *in: pointer to input to be absorbed into s
+*              - size_t inlen:      length of input in bytes
+**************************************************/
+void shake256x2_absorb(keccakx2_state *state,
+                       const uint8_t *in0,
+                       const uint8_t *in1,
+                       size_t inlen) {
+    keccakx2_absorb(state->s, SHAKE256_RATE, in0, in1, inlen, 0x1F);
+}
+
+/*************************************************
+* Name:        shake256_squeezeblocks
+*
+* Description: Squeeze step of SHAKE256 XOF. Squeezes full blocks of
+*              SHAKE256_RATE bytes each. Modifies the state. Can be called
+*              multiple times to keep squeezing, i.e., is incremental.
+*
+* Arguments:   - uint8_t *out:    pointer to output blocks
+*              - size_t nblocks:  number of blocks to be squeezed
+*                                 (written to output)
+*              - keccakx2_state *s: pointer to input/output Keccak state
+**************************************************/
+void shake256x2_squeezeblocks(uint8_t *out0,
+                              uint8_t *out1,
+                              size_t nblocks,
+                              keccakx2_state *state) {
+    keccakx2_squeezeblocks(out0, out1, nblocks, SHAKE256_RATE, state->s);
+}
+
+/*************************************************
+* Name:        shake128
+*
+* Description: SHAKE128 XOF with non-incremental API
+*
+* Arguments:   - uint8_t *out:      pointer to output
+*              - size_t outlen:     requested output length in bytes
+*              - const uint8_t *in: pointer to input
+*              - size_t inlen:      length of input in bytes
+**************************************************/
+void shake128x2(uint8_t *out0,
+                uint8_t *out1,
+                size_t outlen,
+                const uint8_t *in0,
+                const uint8_t *in1,
+                size_t inlen) {
+    unsigned int i;
+    size_t nblocks = outlen / SHAKE128_RATE;
+    uint8_t t[2][SHAKE128_RATE];
+    keccakx2_state state;
+
+    shake128x2_absorb(&state, in0, in1, inlen);
+    shake128x2_squeezeblocks(out0, out1, nblocks, &state);
+
+    out0 += nblocks * SHAKE128_RATE;
+    out1 += nblocks * SHAKE128_RATE;
+    outlen -= nblocks * SHAKE128_RATE;
+
+    if (outlen) {
+        shake128x2_squeezeblocks(t[0], t[1], 1, &state);
+        for (i = 0; i < outlen; ++i) {
+            out0[i] = t[0][i];
+            out1[i] = t[1][i];
+        }
+    }
+}
+
+/*************************************************
+* Name:        shake256
+*
+* Description: SHAKE256 XOF with non-incremental API
+*
+* Arguments:   - uint8_t *out:      pointer to output
+*              - size_t outlen:     requested output length in bytes
+*              - const uint8_t *in: pointer to input
+*              - size_t inlen:      length of input in bytes
+**************************************************/
+void shake256x2(uint8_t *out0,
+                uint8_t *out1,
+                size_t outlen,
+                const uint8_t *in0,
+                const uint8_t *in1,
+                size_t inlen) {
+    unsigned int i;
+    size_t nblocks = outlen / SHAKE256_RATE;
+    uint8_t t[2][SHAKE256_RATE];
+    keccakx2_state state;
+
+    shake256x2_absorb(&state, in0, in1, inlen);
+    shake256x2_squeezeblocks(out0, out1, nblocks, &state);
+
+    out0 += nblocks * SHAKE256_RATE;
+    out1 += nblocks * SHAKE256_RATE;
+    outlen -= nblocks * SHAKE256_RATE;
+
+    if (outlen) {
+        shake256x2_squeezeblocks(t[0], t[1], 1, &state);
+        for (i = 0; i < outlen; ++i) {
+            out0[i] = t[0][i];
+            out1[i] = t[1][i];
+        }
+    }
+}

src/sign/dilithium/dilithium3/aarch64/fips202x2.h

@@ -0,0 +1,60 @@
+#ifndef FIPS202X2_H
+#define FIPS202X2_H
+
+#include "params.h"
+#include <arm_neon.h>
+#include <stddef.h>
+
+typedef uint64x2_t v128;
+
+#define SHAKE128_RATE 168
+#define SHAKE256_RATE 136
+#define SHA3_256_RATE 136
+#define SHA3_512_RATE 72
+
+
+typedef struct {
+    v128 s[25];
+} keccakx2_state;
+
+
+#define shake128x2_absorb DILITHIUM_NAMESPACE(shake128x2_absorb)
+void shake128x2_absorb(keccakx2_state *state,
+                       const uint8_t *in0,
+                       const uint8_t *in1,
+                       size_t inlen);
+
+#define shake128x2_squeezeblocks DILITHIUM_NAMESPACE(shake128x2_squeezeblocks)
+void shake128x2_squeezeblocks(uint8_t *out0,
+                              uint8_t *out1,
+                              size_t nblocks,
+                              keccakx2_state *state);
+
+#define shake256x2_absorb DILITHIUM_NAMESPACE(shake256x2_absorb)
+void shake256x2_absorb(keccakx2_state *state,
+                       const uint8_t *in0,
+                       const uint8_t *in1,
+                       size_t inlen);
+
+#define shake256x2_squeezeblocks DILITHIUM_NAMESPACE(shake256x2_squeezeblocks)
+void shake256x2_squeezeblocks(uint8_t *out0,
+                              uint8_t *out1,
+                              size_t nblocks,
+                              keccakx2_state *state);
+
+#define shake128x2 DILITHIUM_NAMESPACE(shake128x2)
+void shake128x2(uint8_t *out0,
+                uint8_t *out1,
+                size_t outlen,
+                const uint8_t *in0,
+                const uint8_t *in1,
+                size_t inlen);
+
+#define shake256x2 DILITHIUM_NAMESPACE(shake256x2)
+void shake256x2(uint8_t *out0,
+                uint8_t *out1,
+                size_t outlen,
+                const uint8_t *in0,
+                const uint8_t *in1,
+                size_t inlen);
+#endif

src/sign/dilithium/dilithium3/aarch64/macros.inc

@@ -0,0 +1,84 @@
+#include "macros_common.inc"
+
+.macro wrap_trn_4x4 a0, a1, a2, a3, t0, t1, t2, t3, qS, dD
+
+    trn1 \t0\qS, \a0\qS, \a1\qS
+    trn2 \t1\qS, \a0\qS, \a1\qS
+    trn1 \t2\qS, \a2\qS, \a3\qS
+    trn2 \t3\qS, \a2\qS, \a3\qS
+
+    trn1 \a0\dD, \t0\dD, \t2\dD
+    trn2 \a2\dD, \t0\dD, \t2\dD
+    trn1 \a1\dD, \t1\dD, \t3\dD
+    trn2 \a3\dD, \t1\dD, \t3\dD
+
+.endm
+
+.macro trn_4x4 a0, a1, a2, a3, t0, t1, t2, t3
+    wrap_trn_4x4 \a0, \a1, \a2, \a3, \t0, \t1, \t2, \t3, .4S, .2D
+.endm
+
+
+.macro dq_butterfly_vec_bot a0, a1, b0, b1, t0, t1, mod, l0, h0, l1, h1
+    wrap_dX_butterfly_vec_bot \a0, \a1, \b0, \b1, \t0, \t1, \mod, \l0, \h0, \l1, \h1, .4S, .S
+.endm
+
+.macro dq_butterfly_vec_top a0, a1, b0, b1, t0, t1, mod, l0, h0, l1, h1
+    wrap_dX_butterfly_vec_top \a0, \a1, \b0, \b1, \t0, \t1, \mod, \l0, \h0, \l1, \h1, .4S, .S
+.endm
+
+.macro dq_butterfly_vec_mixed a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, l0, h0, l1, h1, l2, h2, l3, h3
+    wrap_dX_butterfly_vec_mixed \a0, \a1, \b0, \b1, \t0, \t1, \a2, \a3, \b2, \b3, \t2, \t3, \mod, \l0, \h0, \l1, \h1, \l2, \h2, \l3, \h3, .4S, .S
+.endm
+
+.macro dq_butterfly_vec_mixed_rev a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, l0, h0, l1, h1, l2, h2, l3, h3
+    wrap_dX_butterfly_vec_mixed_rev \a0, \a1, \b0, \b1, \t0, \t1, \a2, \a3, \b2, \b3, \t2, \t3, \mod, \l0, \h0, \l1, \h1, \l2, \h2, \l3, \h3, .4S, .S
+.endm
+
+
+.macro dq_butterfly_top a0, a1, b0, b1, t0, t1, mod, z0, l0, h0, z1, l1, h1
+    wrap_dX_butterfly_top \a0, \a1, \b0, \b1, \t0, \t1, \mod, \z0, \l0, \h0, \z1, \l1, \h1, .4S, .S
+.endm
+
+.macro dq_butterfly_bot a0, a1, b0, b1, t0, t1, mod, z0, l0, h0, z1, l1, h1
+    wrap_dX_butterfly_bot \a0, \a1, \b0, \b1, \t0, \t1, \mod, \z0, \l0, \h0, \z1, \l1, \h1, .4S, .S
+.endm
+
+.macro dq_butterfly_mixed a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3
+    wrap_dX_butterfly_mixed \a0, \a1, \b0, \b1, \t0, \t1, \a2, \a3, \b2, \b3, \t2, \t3, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, .4S, .S
+.endm
+
+.macro dq_butterfly_mixed_rev a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3
+    wrap_dX_butterfly_mixed_rev \a0, \a1, \b0, \b1, \t0, \t1, \a2, \a3, \b2, \b3, \t2, \t3, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, .4S, .S
+.endm
+
+
+.macro qq_montgomery_mul b0, b1, b2, b3, t0, t1, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3
+    wrap_qX_montgomery_mul \b0, \b1, \b2, \b3, \t0, \t1, \t2, \t3, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, .4S, .S
+.endm
+
+
+.macro qq_butterfly_top a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3
+    wrap_qX_butterfly_top \a0, \a1, \a2, \a3, \b0, \b1, \b2, \b3, \t0, \t1, \t2, \t3, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, .4S, .S
+.endm
+
+.macro qq_butterfly_bot a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3
+    wrap_qX_butterfly_bot \a0, \a1, \a2, \a3, \b0, \b1, \b2, \b3, \t0, \t1, \t2, \t3, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, .4S, .S
+.endm
+
+.macro qq_butterfly_mixed a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, a4, a5, a6, a7, b4, b5, b6, b7, t4, t5, t6, t7, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, z4, l4, h4, z5, l5, h5, z6, l6, h6, z7, l7, h7
+    wrap_qX_butterfly_mixed \a0, \a1, \a2, \a3, \b0, \b1, \b2, \b3, \t0, \t1, \t2, \t3, \a4, \a5, \a6, \a7, \b4, \b5, \b6, \b7, \t4, \t5, \t6, \t7, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, \z4, \l4, \h4, \z5, \l5, \h5, \z6, \l6, \h6, \z7, \l7, \h7, .4S, .S
+.endm
+
+.macro qq_butterfly_mixed_rev a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, a4, a5, a6, a7, b4, b5, b6, b7, t4, t5, t6, t7, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, z4, l4, h4, z5, l5, h5, z6, l6, h6, z7, l7, h7
+    wrap_qX_butterfly_mixed_rev \a0, \a1, \a2, \a3, \b0, \b1, \b2, \b3, \t0, \t1, \t2, \t3, \a4, \a5, \a6, \a7, \b4, \b5, \b6, \b7, \t4, \t5, \t6, \t7, \mod, \z0, \l0, \h0, \z1, \l1, \h1, \z2, \l2, \h2, \z3, \l3, \h3, \z4, \l4, \h4, \z5, \l5, \h5, \z6, \l6, \h6, \z7, \l7, \h7, .4S, .S
+.endm
+
+
+.macro qq_montgomery c0, c1, c2, c3, l0, l1, l2, l3, h0, h1, h2, h3, t0, t1, t2, t3, Qprime, Q
+    wrap_qX_montgomery \c0, \c1, \c2, \c3, \l0, \l1, \l2, \l3, \h0, \h1, \h2, \h3, \t0, \t1, \t2, \t3, \Qprime, \Q, .2S, .4S, .2D
+.endm
+
+.macro qq_sub_add s0, s1, s2, s3, t0, t1, t2, t3, a0, a1, a2, a3, b0, b1, b2, b3
+    wrap_qX_sub_add \s0, \s1, \s2, \s3, \t0, \t1, \t2, \t3, \a0, \a1, \a2, \a3, \b0, \b1, \b2, \b3, .4S
+.endm

src/sign/dilithium/dilithium3/aarch64/macros_common.inc

@@ -0,0 +1,423 @@
+// for ABI
+
+.macro push_all
+
+    sub sp, sp, #(16*9)
+    stp x19, x20, [sp, #16*0]
+    stp x21, x22, [sp, #16*1]
+    stp x23, x24, [sp, #16*2]
+    stp x25, x26, [sp, #16*3]
+    stp x27, x28, [sp, #16*4]
+    stp  d8,  d9, [sp, #16*5]
+    stp d10, d11, [sp, #16*6]
+    stp d12, d13, [sp, #16*7]
+    stp d14, d15, [sp, #16*8]
+
+.endm
+
+.macro pop_all
+
+    ldp x19, x20, [sp, #16*0]
+    ldp x21, x22, [sp, #16*1]
+    ldp x23, x24, [sp, #16*2]
+    ldp x25, x26, [sp, #16*3]
+    ldp x27, x28, [sp, #16*4]
+    ldp  d8,  d9, [sp, #16*5]
+    ldp d10, d11, [sp, #16*6]
+    ldp d12, d13, [sp, #16*7]
+    ldp d14, d15, [sp, #16*8]
+    add sp, sp, #(16*9)
+
+.endm
+
+// vector-scalar butterflies
+
+.macro wrap_dX_butterfly_top a0, a1, b0, b1, t0, t1, mod, z0, l0, h0, z1, l1, h1, wX, nX
+
+    mul      \t0\wX, \b0\wX, \z0\nX[\h0]
+    mul      \t1\wX, \b1\wX, \z1\nX[\h1]
+
+    sqrdmulh \b0\wX, \b0\wX, \z0\nX[\l0]
+    sqrdmulh \b1\wX, \b1\wX, \z1\nX[\l1]
+
+    mls      \t0\wX, \b0\wX, \mod\nX[0]
+    mls      \t1\wX, \b1\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_dX_butterfly_bot a0, a1, b0, b1, t0, t1, mod, z0, l0, h0, z1, l1, h1, wX, nX
+
+    sub     \b0\wX, \a0\wX, \t0\wX
+    sub     \b1\wX, \a1\wX, \t1\wX
+
+    add     \a0\wX, \a0\wX, \t0\wX
+    add     \a1\wX, \a1\wX, \t1\wX
+
+.endm
+
+.macro wrap_dX_butterfly_mixed a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, wX, nX
+
+    sub      \b0\wX, \a0\wX, \t0\wX
+    mul      \t2\wX, \b2\wX, \z2\nX[\h2]
+    sub      \b1\wX, \a1\wX, \t1\wX
+    mul      \t3\wX, \b3\wX, \z3\nX[\h3]
+
+    add      \a0\wX, \a0\wX, \t0\wX
+    sqrdmulh \b2\wX, \b2\wX, \z2\nX[\l2]
+    add      \a1\wX, \a1\wX, \t1\wX
+    sqrdmulh \b3\wX, \b3\wX, \z3\nX[\l3]
+
+    mls      \t2\wX, \b2\wX, \mod\nX[0]
+    mls      \t3\wX, \b3\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_dX_butterfly_mixed_rev a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, wX, nX
+
+    mul      \t0\wX, \b0\wX, \z0\nX[\h0]
+    sub      \b2\wX, \a2\wX, \t2\wX
+    mul      \t1\wX, \b1\wX, \z1\nX[\h1]
+    sub      \b3\wX, \a3\wX, \t3\wX
+
+    sqrdmulh \b0\wX, \b0\wX, \z0\nX[\l0]
+    add      \a2\wX, \a2\wX, \t2\wX
+    sqrdmulh \b1\wX, \b1\wX, \z1\nX[\l1]
+    add      \a3\wX, \a3\wX, \t3\wX
+
+    mls      \t0\wX, \b0\wX, \mod\nX[0]
+    mls      \t1\wX, \b1\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_qX_butterfly_top a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, wX, nX
+
+    mul      \t0\wX, \b0\wX, \z0\nX[\h0]
+    mul      \t1\wX, \b1\wX, \z1\nX[\h1]
+    mul      \t2\wX, \b2\wX, \z2\nX[\h2]
+    mul      \t3\wX, \b3\wX, \z3\nX[\h3]
+
+    sqrdmulh \b0\wX, \b0\wX, \z0\nX[\l0]
+    sqrdmulh \b1\wX, \b1\wX, \z1\nX[\l1]
+    sqrdmulh \b2\wX, \b2\wX, \z2\nX[\l2]
+    sqrdmulh \b3\wX, \b3\wX, \z3\nX[\l3]
+
+    mls      \t0\wX, \b0\wX, \mod\nX[0]
+    mls      \t1\wX, \b1\wX, \mod\nX[0]
+    mls      \t2\wX, \b2\wX, \mod\nX[0]
+    mls      \t3\wX, \b3\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_qX_butterfly_bot a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, wX, nX
+
+    sub     \b0\wX, \a0\wX, \t0\wX
+    sub     \b1\wX, \a1\wX, \t1\wX
+    sub     \b2\wX, \a2\wX, \t2\wX
+    sub     \b3\wX, \a3\wX, \t3\wX
+
+    add     \a0\wX, \a0\wX, \t0\wX
+    add     \a1\wX, \a1\wX, \t1\wX
+    add     \a2\wX, \a2\wX, \t2\wX
+    add     \a3\wX, \a3\wX, \t3\wX
+
+.endm
+
+.macro wrap_qX_butterfly_mixed a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, a4, a5, a6, a7, b4, b5, b6, b7, t4, t5, t6, t7, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, z4, l4, h4, z5, l5, h5, z6, l6, h6, z7, l7, h7, wX, nX
+
+    sub      \b0\wX, \a0\wX, \t0\wX
+    mul      \t4\wX, \b4\wX, \z4\nX[\h4]
+    sub      \b1\wX, \a1\wX, \t1\wX
+    mul      \t5\wX, \b5\wX, \z5\nX[\h5]
+    sub      \b2\wX, \a2\wX, \t2\wX
+    mul      \t6\wX, \b6\wX, \z6\nX[\h6]
+    sub      \b3\wX, \a3\wX, \t3\wX
+    mul      \t7\wX, \b7\wX, \z7\nX[\h7]
+
+    add      \a0\wX, \a0\wX, \t0\wX
+    sqrdmulh \b4\wX, \b4\wX, \z4\nX[\l4]
+    add      \a1\wX, \a1\wX, \t1\wX
+    sqrdmulh \b5\wX, \b5\wX, \z5\nX[\l5]
+    add      \a2\wX, \a2\wX, \t2\wX
+    sqrdmulh \b6\wX, \b6\wX, \z6\nX[\l6]
+    add      \a3\wX, \a3\wX, \t3\wX
+    sqrdmulh \b7\wX, \b7\wX, \z7\nX[\l7]
+
+    mls      \t4\wX, \b4\wX, \mod\nX[0]
+    mls      \t5\wX, \b5\wX, \mod\nX[0]
+    mls      \t6\wX, \b6\wX, \mod\nX[0]
+    mls      \t7\wX, \b7\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_qX_butterfly_mixed_rev a0, a1, a2, a3, b0, b1, b2, b3, t0, t1, t2, t3, a4, a5, a6, a7, b4, b5, b6, b7, t4, t5, t6, t7, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, z4, l4, h4, z5, l5, h5, z6, l6, h6, z7, l7, h7, wX, nX
+
+    mul      \t0\wX, \b0\wX, \z0\nX[\h0]
+    sub      \b4\wX, \a4\wX, \t4\wX
+    mul      \t1\wX, \b1\wX, \z1\nX[\h1]
+    sub      \b5\wX, \a5\wX, \t5\wX
+    mul      \t2\wX, \b2\wX, \z2\nX[\h2]
+    sub      \b6\wX, \a6\wX, \t6\wX
+    mul      \t3\wX, \b3\wX, \z3\nX[\h3]
+    sub      \b7\wX, \a7\wX, \t7\wX
+
+    sqrdmulh \b0\wX, \b0\wX, \z0\nX[\l0]
+    add      \a4\wX, \a4\wX, \t4\wX
+    sqrdmulh \b1\wX, \b1\wX, \z1\nX[\l1]
+    add      \a5\wX, \a5\wX, \t5\wX
+    sqrdmulh \b2\wX, \b2\wX, \z2\nX[\l2]
+    add      \a6\wX, \a6\wX, \t6\wX
+    sqrdmulh \b3\wX, \b3\wX, \z3\nX[\l3]
+    add      \a7\wX, \a7\wX, \t7\wX
+
+    mls      \t0\wX, \b0\wX, \mod\nX[0]
+    mls      \t1\wX, \b1\wX, \mod\nX[0]
+    mls      \t2\wX, \b2\wX, \mod\nX[0]
+    mls      \t3\wX, \b3\wX, \mod\nX[0]
+
+.endm
+
+// vector-vector butterflies
+
+.macro wrap_dX_butterfly_vec_top a0, a1, b0, b1, t0, t1, mod, l0, h0, l1, h1, wX, nX
+
+    mul      \t0\wX, \b0\wX, \h0\wX
+    mul      \t1\wX, \b1\wX, \h1\wX
+
+    sqrdmulh \b0\wX, \b0\wX, \l0\wX
+    sqrdmulh \b1\wX, \b1\wX, \l1\wX
+
+    mls      \t0\wX, \b0\wX, \mod\nX[0]
+    mls      \t1\wX, \b1\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_dX_butterfly_vec_bot a0, a1, b0, b1, t0, t1, mod, l0, h0, l1, h1, wX, nX
+
+    sub     \b0\wX, \a0\wX, \t0\wX
+    sub     \b1\wX, \a1\wX, \t1\wX
+
+    add     \a0\wX, \a0\wX, \t0\wX
+    add     \a1\wX, \a1\wX, \t1\wX
+
+.endm
+
+.macro wrap_dX_butterfly_vec_mixed a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, l0, h0, l1, h1, l2, h2, l3, h3, wX, nX
+
+    sub      \b0\wX, \a0\wX, \t0\wX
+    mul      \t2\wX, \b2\wX, \h2\wX
+    sub      \b1\wX, \a1\wX, \t1\wX
+    mul      \t3\wX, \b3\wX, \h3\wX
+
+    add      \a0\wX, \a0\wX, \t0\wX
+    sqrdmulh \b2\wX, \b2\wX, \l2\wX
+    add      \a1\wX, \a1\wX, \t1\wX
+    sqrdmulh \b3\wX, \b3\wX, \l3\wX
+
+    mls      \t2\wX, \b2\wX, \mod\nX[0]
+    mls      \t3\wX, \b3\wX, \mod\nX[0]
+
+.endm
+
+.macro wrap_dX_butterfly_vec_mixed_rev a0, a1, b0, b1, t0, t1, a2, a3, b2, b3, t2, t3, mod, l0, h0, l1, h1, l2, h2, l3, h3, wX, nX
+
+    mul      \t0\wX, \b0\wX, \h0\wX
+    sub      \b2\wX, \a2\wX, \t2\wX
+    mul      \t1\wX, \b1\wX, \h1\wX
+    sub      \b3\wX, \a3\wX, \t3\wX
+
+    sqrdmulh \b0\wX, \b0\wX, \l0\wX
+    add      \a2\wX, \a2\wX, \t2\wX
+    sqrdmulh \b1\wX, \b1\wX, \l1\wX
+    add      \a3\wX, \a3\wX, \t3\wX
+
+    mls      \t0\wX, \b0\wX, \mod\nX[0]
+    mls      \t1\wX, \b1\wX, \mod\nX[0]
+
+.endm
+
+// vector-scalar Barrett reduction
+
+.macro wrap_qX_barrett a0, a1, a2, a3, t0, t1, t2, t3, barrett_const, shrv, Q, wX, nX
+
+    sqdmulh \t0\wX, \a0\wX, \barrett_const\nX[0]
+    sqdmulh \t1\wX, \a1\wX, \barrett_const\nX[0]
+
+    sqdmulh \t2\wX, \a2\wX, \barrett_const\nX[0]
+    srshr   \t0\wX, \t0\wX, \shrv
+    sqdmulh \t3\wX, \a3\wX, \barrett_const\nX[0]
+    srshr   \t1\wX, \t1\wX, \shrv
+
+    srshr   \t2\wX, \t2\wX, \shrv
+    mls     \a0\wX, \t0\wX, \Q\wX
+    srshr   \t3\wX, \t3\wX, \shrv
+    mls     \a1\wX, \t1\wX, \Q\wX
+
+    mls     \a2\wX, \t2\wX, \Q\wX
+    mls     \a3\wX, \t3\wX, \Q\wX
+
+.endm
+
+.macro wrap_oX_barrett a0, a1, a2, a3, t0, t1, t2, t3, a4, a5, a6, a7, t4, t5, t6, t7, barrett_const, shrv, Q, wX, nX
+
+    sqdmulh \t0\wX, \a0\wX, \barrett_const\nX[0]
+    sqdmulh \t1\wX, \a1\wX, \barrett_const\nX[0]
+    sqdmulh \t2\wX, \a2\wX, \barrett_const\nX[0]
+    sqdmulh \t3\wX, \a3\wX, \barrett_const\nX[0]
+
+    srshr   \t0\wX, \t0\wX, \shrv
+    sqdmulh \t4\wX, \a4\wX, \barrett_const\nX[0]
+    srshr   \t1\wX, \t1\wX, \shrv
+    sqdmulh \t5\wX, \a5\wX, \barrett_const\nX[0]
+    srshr   \t2\wX, \t2\wX, \shrv
+    sqdmulh \t6\wX, \a6\wX, \barrett_const\nX[0]
+    srshr   \t3\wX, \t3\wX, \shrv
+    sqdmulh \t7\wX, \a7\wX, \barrett_const\nX[0]
+
+    mls     \a0\wX, \t0\wX, \Q\wX
+    srshr   \t4\wX, \t4\wX, \shrv
+    mls     \a1\wX, \t1\wX, \Q\wX
+    srshr   \t5\wX, \t5\wX, \shrv
+    mls     \a2\wX, \t2\wX, \Q\wX
+    srshr   \t6\wX, \t6\wX, \shrv
+    mls     \a3\wX, \t3\wX, \Q\wX
+    srshr   \t7\wX, \t7\wX, \shrv
+
+    mls     \a4\wX, \t4\wX, \Q\wX
+    mls     \a5\wX, \t5\wX, \Q\wX
+    mls     \a6\wX, \t6\wX, \Q\wX
+    mls     \a7\wX, \t7\wX, \Q\wX
+
+.endm
+
+// vector-vector Barrett reduction
+
+.macro wrap_qo_barrett_vec a0, a1, a2, a3, t0, t1, t2, t3, barrett_const, shrv, Q, wX, nX
+
+    sqdmulh \t0\wX, \a0\wX, \barrett_const\wX
+    sqdmulh \t1\wX, \a1\wX, \barrett_const\wX
+
+    sqdmulh \t2\wX, \a2\wX, \barrett_const\wX
+    srshr   \t0\wX, \t0\wX, \shrv
+    sqdmulh \t3\wX, \a3\wX, \barrett_const\wX
+    srshr   \t1\wX, \t1\wX, \shrv
+
+    srshr   \t2\wX, \t2\wX, \shrv
+    mls     \a0\wX, \t0\wX, \Q\wX
+    srshr   \t3\wX, \t3\wX, \shrv
+    mls     \a1\wX, \t1\wX, \Q\wX
+
+    mls     \a2\wX, \t2\wX, \Q\wX
+    mls     \a3\wX, \t3\wX, \Q\wX
+
+.endm
+
+.macro wrap_oo_barrett_vec a0, a1, a2, a3, t0, t1, t2, t3, a4, a5, a6, a7, t4, t5, t6, t7, barrett_const, shrv, Q, wX, nX
+
+    sqdmulh \t0\wX, \a0\wX, \barrett_const\wX
+    sqdmulh \t1\wX, \a1\wX, \barrett_const\wX
+    sqdmulh \t2\wX, \a2\wX, \barrett_const\wX
+    sqdmulh \t3\wX, \a3\wX, \barrett_const\wX
+
+    srshr   \t0\wX, \t0\wX, \shrv
+    sqdmulh \t4\wX, \a4\wX, \barrett_const\wX
+    srshr   \t1\wX, \t1\wX, \shrv
+    sqdmulh \t5\wX, \a5\wX, \barrett_const\wX
+    srshr   \t2\wX, \t2\wX, \shrv
+    sqdmulh \t6\wX, \a6\wX, \barrett_const\wX
+    srshr   \t3\wX, \t3\wX, \shrv
+    sqdmulh \t7\wX, \a7\wX, \barrett_const\wX
+
+    mls     \a0\wX, \t0\wX, \Q\wX
+    srshr   \t4\wX, \t4\wX, \shrv
+    mls     \a1\wX, \t1\wX, \Q\wX
+    srshr   \t5\wX, \t5\wX, \shrv
+    mls     \a2\wX, \t2\wX, \Q\wX
+    srshr   \t6\wX, \t6\wX, \shrv
+    mls     \a3\wX, \t3\wX, \Q\wX
+    srshr   \t7\wX, \t7\wX, \shrv
+
+    mls     \a4\wX, \t4\wX, \Q\wX
+    mls     \a5\wX, \t5\wX, \Q\wX
+    mls     \a6\wX, \t6\wX, \Q\wX
+    mls     \a7\wX, \t7\wX, \Q\wX
+
+.endm
+
+// Montgomery multiplication
+
+.macro wrap_qX_montgomery_mul b0, b1, b2, b3, t0, t1, t2, t3, mod, z0, l0, h0, z1, l1, h1, z2, l2, h2, z3, l3, h3, wX, nX
+
+    mul      \b0\wX, \t0\wX, \z0\nX[\h0]
+    mul      \b1\wX, \t1\wX, \z1\nX[\h1]
+    mul      \b2\wX, \t2\wX, \z2\nX[\h2]
+    mul      \b3\wX, \t3\wX, \z3\nX[\h3]
+
+    sqrdmulh \t0\wX, \t0\wX, \z0\nX[\l0]
+    sqrdmulh \t1\wX, \t1\wX, \z1\nX[\l1]
+    sqrdmulh \t2\wX, \t2\wX, \z2\nX[\l2]
+    sqrdmulh \t3\wX, \t3\wX, \z3\nX[\l3]
+
+    mls      \b0\wX, \t0\wX, \mod\nX[0]
+    mls      \b1\wX, \t1\wX, \mod\nX[0]
+    mls      \b2\wX, \t2\wX, \mod\nX[0]
+    mls      \b3\wX, \t3\wX, \mod\nX[0]
+
+.endm
+
+// Montgomery reduction with long
+
+.macro wrap_qX_montgomery c0, c1, c2, c3, l0, l1, l2, l3, h0, h1, h2, h3, t0, t1, t2, t3, Qprime, Q, lX, wX, dwX
+
+    uzp1 \t0\wX, \l0\wX, \h0\wX
+    uzp1 \t1\wX, \l1\wX, \h1\wX
+    uzp1 \t2\wX, \l2\wX, \h2\wX
+    uzp1 \t3\wX, \l3\wX, \h3\wX
+
+    mul \t0\wX, \t0\wX, \Qprime\wX
+    mul \t1\wX, \t1\wX, \Qprime\wX
+    mul \t2\wX, \t2\wX, \Qprime\wX
+    mul \t3\wX, \t3\wX, \Qprime\wX
+
+    smlal  \l0\dwX, \t0\lX, \Q\lX
+    smlal2 \h0\dwX, \t0\wX, \Q\wX
+    smlal  \l1\dwX, \t1\lX, \Q\lX
+    smlal2 \h1\dwX, \t1\wX, \Q\wX
+    smlal  \l2\dwX, \t2\lX, \Q\lX
+    smlal2 \h2\dwX, \t2\wX, \Q\wX
+    smlal  \l3\dwX, \t3\lX, \Q\lX
+    smlal2 \h3\dwX, \t3\wX, \Q\wX
+
+    uzp2 \c0\wX, \l0\wX, \h0\wX
+    uzp2 \c1\wX, \l1\wX, \h1\wX
+    uzp2 \c2\wX, \l2\wX, \h2\wX
+    uzp2 \c3\wX, \l3\wX, \h3\wX
+
+.endm
+
+// add_sub, sub_add
+
+.macro wrap_qX_add_sub s0, s1, s2, s3, t0, t1, t2, t3, a0, a1, a2, a3, b0, b1, b2, b3, wX
+
+    add \s0\wX, \a0\wX, \b0\wX
+    sub \t0\wX, \a0\wX, \b0\wX
+    add \s1\wX, \a1\wX, \b1\wX
+    sub \t1\wX, \a1\wX, \b1\wX
+    add \s2\wX, \a2\wX, \b2\wX
+    sub \t2\wX, \a2\wX, \b2\wX
+    add \s3\wX, \a3\wX, \b3\wX
+    sub \t3\wX, \a3\wX, \b3\wX
+
+.endm
+
+.macro wrap_qX_sub_add s0, s1, s2, s3, t0, t1, t2, t3, a0, a1, a2, a3, b0, b1, b2, b3, wX
+
+    sub \t0\wX, \a0\wX, \b0\wX
+    add \s0\wX, \a0\wX, \b0\wX
+    sub \t1\wX, \a1\wX, \b1\wX
+    add \s1\wX, \a1\wX, \b1\wX
+    sub \t2\wX, \a2\wX, \b2\wX
+    add \s2\wX, \a2\wX, \b2\wX
+    sub \t3\wX, \a3\wX, \b3\wX
+    add \s3\wX, \a3\wX, \b3\wX
+
+.endm

src/sign/dilithium/dilithium3/aarch64/ntt.c

@@ -0,0 +1,35 @@
+#include "params.h"
+#include "reduce.h"
+#include <stdint.h>
+#include <stdio.h>
+
+#include "NTT_params.h"
+#include "ntt.h"
+
+
+/*************************************************
+* Name:        ntt
+*
+* Description: Forward NTT, in-place. No modular reduction is performed after
+*              additions or subtractions. Output vector is in bitreversed order.
+*
+* Arguments:   - uint32_t p[N]: input/output coefficient array
+**************************************************/
+void ntt(int32_t a[N]) {
+    NTT(a);
+}
+
+/*************************************************
+* Name:        invntt_tomont
+*
+* Description: Inverse NTT and multiplication by Montgomery factor 2^32.
+*              In-place. No modular reductions after additions or
+*              subtractions; input coefficients need to be smaller than
+*              Q in absolute value. Output coefficient are smaller than Q in
+*              absolute value.
+*
+* Arguments:   - uint32_t p[N]: input/output coefficient array
+**************************************************/
+void invntt_tomont(int32_t a[N]) {
+    iNTT(a);
+}

src/sign/dilithium/dilithium3/aarch64/packing.c

@@ -0,0 +1,261 @@
+#include "packing.h"
+#include "params.h"
+#include "poly.h"
+#include "polyvec.h"
+
+
+/*************************************************
+* Name:        pack_pk
+*
+* Description: Bit-pack public key pk = (rho, t1).
+*
+* Arguments:   - uint8_t pk[]: output byte array
+*              - const uint8_t rho[]: byte array containing rho
+*              - const polyveck *t1: pointer to vector t1
+**************************************************/
+void pack_pk(uint8_t pk[CRYPTO_PUBLICKEYBYTES],
+             const uint8_t rho[SEEDBYTES],
+             const polyveck *t1) {
+    unsigned int i;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        pk[i] = rho[i];
+    }
+    pk += SEEDBYTES;
+
+    for (i = 0; i < K; ++i) {
+        polyt1_pack(pk + i * POLYT1_PACKEDBYTES, &t1->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        unpack_pk
+*
+* Description: Unpack public key pk = (rho, t1).
+*
+* Arguments:   - const uint8_t rho[]: output byte array for rho
+*              - const polyveck *t1: pointer to output vector t1
+*              - uint8_t pk[]: byte array containing bit-packed pk
+**************************************************/
+void unpack_pk(uint8_t rho[SEEDBYTES],
+               polyveck *t1,
+               const uint8_t pk[CRYPTO_PUBLICKEYBYTES]) {
+    unsigned int i;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        rho[i] = pk[i];
+    }
+    pk += SEEDBYTES;
+
+    for (i = 0; i < K; ++i) {
+        polyt1_unpack(&t1->vec[i], pk + i * POLYT1_PACKEDBYTES);
+    }
+}
+
+/*************************************************
+* Name:        pack_sk
+*
+* Description: Bit-pack secret key sk = (rho, tr, key, t0, s1, s2).
+*
+* Arguments:   - uint8_t sk[]: output byte array
+*              - const uint8_t rho[]: byte array containing rho
+*              - const uint8_t tr[]: byte array containing tr
+*              - const uint8_t key[]: byte array containing key
+*              - const polyveck *t0: pointer to vector t0
+*              - const polyvecl *s1: pointer to vector s1
+*              - const polyveck *s2: pointer to vector s2
+**************************************************/
+void pack_sk(uint8_t sk[CRYPTO_SECRETKEYBYTES],
+             const uint8_t rho[SEEDBYTES],
+             const uint8_t tr[SEEDBYTES],
+             const uint8_t key[SEEDBYTES],
+             const polyveck *t0,
+             const polyvecl *s1,
+             const polyveck *s2) {
+    unsigned int i;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        sk[i] = rho[i];
+    }
+    sk += SEEDBYTES;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        sk[i] = key[i];
+    }
+    sk += SEEDBYTES;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        sk[i] = tr[i];
+    }
+    sk += SEEDBYTES;
+
+    for (i = 0; i < L; ++i) {
+        polyeta_pack(sk + i * POLYETA_PACKEDBYTES, &s1->vec[i]);
+    }
+    sk += L * POLYETA_PACKEDBYTES;
+
+    for (i = 0; i < K; ++i) {
+        polyeta_pack(sk + i * POLYETA_PACKEDBYTES, &s2->vec[i]);
+    }
+    sk += K * POLYETA_PACKEDBYTES;
+
+    for (i = 0; i < K; ++i) {
+        polyt0_pack(sk + i * POLYT0_PACKEDBYTES, &t0->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        unpack_sk
+*
+* Description: Unpack secret key sk = (rho, tr, key, t0, s1, s2).
+*
+* Arguments:   - const uint8_t rho[]: output byte array for rho
+*              - const uint8_t tr[]: output byte array for tr
+*              - const uint8_t key[]: output byte array for key
+*              - const polyveck *t0: pointer to output vector t0
+*              - const polyvecl *s1: pointer to output vector s1
+*              - const polyveck *s2: pointer to output vector s2
+*              - uint8_t sk[]: byte array containing bit-packed sk
+**************************************************/
+void unpack_sk(uint8_t rho[SEEDBYTES],
+               uint8_t tr[SEEDBYTES],
+               uint8_t key[SEEDBYTES],
+               polyveck *t0,
+               polyvecl *s1,
+               polyveck *s2,
+               const uint8_t sk[CRYPTO_SECRETKEYBYTES]) {
+    unsigned int i;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        rho[i] = sk[i];
+    }
+    sk += SEEDBYTES;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        key[i] = sk[i];
+    }
+    sk += SEEDBYTES;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        tr[i] = sk[i];
+    }
+    sk += SEEDBYTES;
+
+    for (i = 0; i < L; ++i) {
+        polyeta_unpack(&s1->vec[i], sk + i * POLYETA_PACKEDBYTES);
+    }
+    sk += L * POLYETA_PACKEDBYTES;
+
+    for (i = 0; i < K; ++i) {
+        polyeta_unpack(&s2->vec[i], sk + i * POLYETA_PACKEDBYTES);
+    }
+    sk += K * POLYETA_PACKEDBYTES;
+
+    for (i = 0; i < K; ++i) {
+        polyt0_unpack(&t0->vec[i], sk + i * POLYT0_PACKEDBYTES);
+    }
+}
+
+/*************************************************
+* Name:        pack_sig
+*
+* Description: Bit-pack signature sig = (c, z, h).
+*
+* Arguments:   - uint8_t sig[]: output byte array
+*              - const uint8_t *c: pointer to challenge hash length SEEDBYTES
+*              - const polyvecl *z: pointer to vector z
+*              - const polyveck *h: pointer to hint vector h
+**************************************************/
+void pack_sig(uint8_t sig[CRYPTO_BYTES],
+              const uint8_t c[SEEDBYTES],
+              const polyvecl *z,
+              const polyveck *h) {
+    unsigned int i, j, k;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        sig[i] = c[i];
+    }
+    sig += SEEDBYTES;
+
+    for (i = 0; i < L; ++i) {
+        polyz_pack(sig + i * POLYZ_PACKEDBYTES, &z->vec[i]);
+    }
+    sig += L * POLYZ_PACKEDBYTES;
+
+    /* Encode h */
+    for (i = 0; i < OMEGA + K; ++i) {
+        sig[i] = 0;
+    }
+
+    k = 0;
+    for (i = 0; i < K; ++i) {
+        for (j = 0; j < N; ++j) {
+            if (h->vec[i].coeffs[j] != 0) {
+                sig[k++] = (uint8_t) j;
+            }
+        }
+
+        sig[OMEGA + i] = (uint8_t) k;
+    }
+}
+
+/*************************************************
+* Name:        unpack_sig
+*
+* Description: Unpack signature sig = (c, z, h).
+*
+* Arguments:   - uint8_t *c: pointer to output challenge hash
+*              - polyvecl *z: pointer to output vector z
+*              - polyveck *h: pointer to output hint vector h
+*              - const uint8_t sig[]: byte array containing
+*                bit-packed signature
+*
+* Returns 1 in case of malformed signature; otherwise 0.
+**************************************************/
+int unpack_sig(uint8_t c[SEEDBYTES],
+               polyvecl *z,
+               polyveck *h,
+               const uint8_t sig[CRYPTO_BYTES]) {
+    unsigned int i, j, k;
+
+    for (i = 0; i < SEEDBYTES; ++i) {
+        c[i] = sig[i];
+    }
+    sig += SEEDBYTES;
+
+    for (i = 0; i < L; ++i) {
+        polyz_unpack(&z->vec[i], sig + i * POLYZ_PACKEDBYTES);
+    }
+    sig += L * POLYZ_PACKEDBYTES;
+
+    /* Decode h */
+    k = 0;
+    for (i = 0; i < K; ++i) {
+        for (j = 0; j < N; ++j) {
+            h->vec[i].coeffs[j] = 0;
+        }
+
+        if (sig[OMEGA + i] < k || sig[OMEGA + i] > OMEGA) {
+            return 1;
+        }
+
+        for (j = k; j < sig[OMEGA + i]; ++j) {
+            /* Coefficients are ordered for strong unforgeability */
+            if (j > k && sig[j] <= sig[j - 1]) {
+                return 1;
+            }
+            h->vec[i].coeffs[sig[j]] = 1;
+        }
+
+        k = sig[OMEGA + i];
+    }
+
+    /* Extra indices are zero for strong unforgeability */
+    for (j = k; j < OMEGA; ++j) {
+        if (sig[j]) {
+            return 1;
+        }
+    }
+
+    return 0;
+}

src/sign/dilithium/dilithium3/aarch64/packing.h

@@ -0,0 +1,37 @@
+#ifndef PACKING_H
+#define PACKING_H
+#include "params.h"
+#include "polyvec.h"
+#include <stdint.h>
+
+#define pack_pk DILITHIUM_NAMESPACE(pack_pk)
+void pack_pk(uint8_t pk[CRYPTO_PUBLICKEYBYTES], const uint8_t rho[SEEDBYTES], const polyveck *t1);
+
+#define pack_sk DILITHIUM_NAMESPACE(pack_sk)
+void pack_sk(uint8_t sk[CRYPTO_SECRETKEYBYTES],
+             const uint8_t rho[SEEDBYTES],
+             const uint8_t tr[SEEDBYTES],
+             const uint8_t key[SEEDBYTES],
+             const polyveck *t0,
+             const polyvecl *s1,
+             const polyveck *s2);
+
+#define pack_sig DILITHIUM_NAMESPACE(pack_sig)
+void pack_sig(uint8_t sig[CRYPTO_BYTES], const uint8_t c[SEEDBYTES], const polyvecl *z, const polyveck *h);
+
+#define unpack_pk DILITHIUM_NAMESPACE(unpack_pk)
+void unpack_pk(uint8_t rho[SEEDBYTES], polyveck *t1, const uint8_t pk[CRYPTO_PUBLICKEYBYTES]);
+
+#define unpack_sk DILITHIUM_NAMESPACE(unpack_sk)
+void unpack_sk(uint8_t rho[SEEDBYTES],
+               uint8_t tr[SEEDBYTES],
+               uint8_t key[SEEDBYTES],
+               polyveck *t0,
+               polyvecl *s1,
+               polyveck *s2,
+               const uint8_t sk[CRYPTO_SECRETKEYBYTES]);
+
+#define unpack_sig DILITHIUM_NAMESPACE(unpack_sig)
+int unpack_sig(uint8_t c[SEEDBYTES], polyvecl *z, polyveck *h, const uint8_t sig[CRYPTO_BYTES]);
+
+#endif

src/sign/dilithium/dilithium3/aarch64/params.h

@@ -0,0 +1,51 @@
+#ifndef PARAMS_H
+#define PARAMS_H
+
+//#define DILITHIUM_MODE 2
+#define DILITHIUM_MODE 3
+//#define DILITHIUM_MODE 5
+
+#define CRYPTO_NAMESPACETOP PQCLEAN_DILITHIUM3_AARCH64_crypto_sign
+#define CRYPTO_NAMESPACE(s) PQCLEAN_DILITHIUM3_AARCH64_##s
+#define DILITHIUM_NAMESPACETOP CRYPTO_NAMESPACETOP
+#define DILITHIUM_NAMESPACE(s) CRYPTO_NAMESPACE(s)
+
+
+#define SEEDBYTES 32
+#define CRHBYTES 64
+#define N 256
+#define DILITHIUM_Q 8380417
+#define D 13
+#define ROOT_OF_UNITY 1753
+
+
+#define K 6
+#define L 5
+#define ETA 4
+#define TAU 49
+#define BETA 196
+#define GAMMA1 (1 << 19)
+#define GAMMA2 ((DILITHIUM_Q-1)/32)
+#define OMEGA 55
+#define CRYPTO_ALGNAME "Dilithium3"
+
+
+#define POLYT1_PACKEDBYTES  320
+#define POLYT0_PACKEDBYTES  416
+#define POLYVECH_PACKEDBYTES (OMEGA + K)
+
+
+#define POLYZ_PACKEDBYTES   640
+
+#define POLYW1_PACKEDBYTES  128
+
+#define POLYETA_PACKEDBYTES 128
+
+#define CRYPTO_PUBLICKEYBYTES (SEEDBYTES + K*POLYT1_PACKEDBYTES)
+#define CRYPTO_SECRETKEYBYTES (3*SEEDBYTES \
+                               + L*POLYETA_PACKEDBYTES \
+                               + K*POLYETA_PACKEDBYTES \
+                               + K*POLYT0_PACKEDBYTES)
+#define CRYPTO_BYTES (SEEDBYTES + L*POLYZ_PACKEDBYTES + POLYVECH_PACKEDBYTES)
+
+#endif

src/sign/dilithium/dilithium3/aarch64/poly.c

@@ -0,0 +1,891 @@
+#include "params.h"
+#include "poly.h"
+#include "reduce.h"
+#include "rounding.h"
+#include "symmetric.h"
+#include <stdint.h>
+
+#include "fips202x2.h"
+
+#include "NTT_params.h"
+#include "ntt.h"
+
+static const int32_t montgomery_const[4] = {
+    DILITHIUM_Q, DILITHIUM_QINV
+};
+
+#define DBENCH_START()
+#define DBENCH_STOP(t)
+
+/*************************************************
+* Name:        poly_reduce
+*
+* Description: Inplace reduction of all coefficients of polynomial to
+*              representative in [-6283009,6283007].
+*
+* Arguments:   - poly *a: pointer to input/output polynomial
+**************************************************/
+extern void PQCLEAN_DILITHIUM3_AARCH64_asm_poly_reduce(int32_t *, const int32_t *);
+void poly_reduce(poly *a) {
+    DBENCH_START();
+
+    PQCLEAN_DILITHIUM3_AARCH64_asm_poly_reduce(a->coeffs, montgomery_const);
+
+    DBENCH_STOP(*tred);
+}
+
+/*************************************************
+* Name:        poly_caddq
+*
+* Description: For all coefficients of in/out polynomial add Q if
+*              coefficient is negative.
+*
+* Arguments:   - poly *a: pointer to input/output polynomial
+**************************************************/
+extern void PQCLEAN_DILITHIUM3_AARCH64_asm_poly_caddq(int32_t *, const int32_t *);
+void poly_caddq(poly *a) {
+    DBENCH_START();
+
+    PQCLEAN_DILITHIUM3_AARCH64_asm_poly_caddq(a->coeffs, montgomery_const);
+
+    DBENCH_STOP(*tred);
+}
+
+/*************************************************
+* Name:        poly_freeze
+*
+* Description: Inplace reduction of all coefficients of polynomial to
+*              standard representatives.
+*
+* Arguments:   - poly *a: pointer to input/output polynomial
+**************************************************/
+extern void PQCLEAN_DILITHIUM3_AARCH64_asm_poly_freeze(int32_t *, const int32_t *);
+void poly_freeze(poly *a) {
+    DBENCH_START();
+
+    PQCLEAN_DILITHIUM3_AARCH64_asm_poly_freeze(a->coeffs, montgomery_const);
+
+    DBENCH_STOP(*tred);
+}
+
+/*************************************************
+* Name:        poly_add
+*
+* Description: Add polynomials. No modular reduction is performed.
+*
+* Arguments:   - poly *c: pointer to output polynomial
+*              - const poly *a: pointer to first summand
+*              - const poly *b: pointer to second summand
+**************************************************/
+void poly_add(poly *c, const poly *a, const poly *b)  {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N; ++i) {
+        c->coeffs[i] = a->coeffs[i] + b->coeffs[i];
+    }
+
+    DBENCH_STOP(*tadd);
+}
+
+/*************************************************
+* Name:        poly_sub
+*
+* Description: Subtract polynomials. No modular reduction is
+*              performed.
+*
+* Arguments:   - poly *c: pointer to output polynomial
+*              - const poly *a: pointer to first input polynomial
+*              - const poly *b: pointer to second input polynomial to be
+*                               subtraced from first input polynomial
+**************************************************/
+void poly_sub(poly *c, const poly *a, const poly *b) {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N; ++i) {
+        c->coeffs[i] = a->coeffs[i] - b->coeffs[i];
+    }
+
+    DBENCH_STOP(*tadd);
+}
+
+/*************************************************
+* Name:        poly_shiftl
+*
+* Description: Multiply polynomial by 2^D without modular reduction. Assumes
+*              input coefficients to be less than 2^{31-D} in absolute value.
+*
+* Arguments:   - poly *a: pointer to input/output polynomial
+**************************************************/
+void poly_shiftl(poly *a) {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N; ++i) {
+        a->coeffs[i] <<= D;
+    }
+
+    DBENCH_STOP(*tmul);
+}
+
+/*************************************************
+* Name:        poly_ntt
+*
+* Description: Inplace forward NTT. Coefficients can grow by
+*              8*Q in absolute value.
+*
+* Arguments:   - poly *a: pointer to input/output polynomial
+**************************************************/
+void poly_ntt(poly *a) {
+    DBENCH_START();
+
+    ntt(a->coeffs);
+
+    DBENCH_STOP(*tmul);
+}
+
+/*************************************************
+* Name:        poly_invntt_tomont
+*
+* Description: Inplace inverse NTT and multiplication by 2^{32}.
+*              Input coefficients need to be less than Q in absolute
+*              value and output coefficients are again bounded by Q.
+*
+* Arguments:   - poly *a: pointer to input/output polynomial
+**************************************************/
+void poly_invntt_tomont(poly *a) {
+    DBENCH_START();
+
+    invntt_tomont(a->coeffs);
+
+    DBENCH_STOP(*tmul);
+}
+
+/*************************************************
+* Name:        poly_pointwise_montgomery
+*
+* Description: Pointwise multiplication of polynomials in NTT domain
+*              representation and multiplication of resulting polynomial
+*              by 2^{-32}.
+*
+* Arguments:   - poly *c: pointer to output polynomial
+*              - const poly *a: pointer to first input polynomial
+*              - const poly *b: pointer to second input polynomial
+**************************************************/
+extern void PQCLEAN_DILITHIUM3_AARCH64_asm_poly_pointwise_montgomery(int32_t *des, const int32_t *src1, const int32_t *src2, const int32_t *table);
+void poly_pointwise_montgomery(poly *c, const poly *a, const poly *b) {
+    DBENCH_START();
+
+    PQCLEAN_DILITHIUM3_AARCH64_asm_poly_pointwise_montgomery(c->coeffs, a->coeffs, b->coeffs, montgomery_const);
+
+    DBENCH_STOP(*tmul);
+}
+
+/*************************************************
+* Name:        poly_power2round
+*
+* Description: For all coefficients c of the input polynomial,
+*              compute c0, c1 such that c mod Q = c1*2^D + c0
+*              with -2^{D-1} < c0 <= 2^{D-1}. Assumes coefficients to be
+*              standard representatives.
+*
+* Arguments:   - poly *a1: pointer to output polynomial with coefficients c1
+*              - poly *a0: pointer to output polynomial with coefficients c0
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+extern void PQCLEAN_DILITHIUM3_AARCH64_asm_poly_power2round(int32_t *, int32_t *, const int32_t *);
+void poly_power2round(poly *a1, poly *a0, const poly *a) {
+    DBENCH_START();
+
+    PQCLEAN_DILITHIUM3_AARCH64_asm_poly_power2round(a1->coeffs, a0->coeffs, a->coeffs);
+
+    DBENCH_STOP(*tround);
+}
+
+/*************************************************
+* Name:        poly_decompose
+*
+* Description: For all coefficients c of the input polynomial,
+*              compute high and low bits c0, c1 such c mod Q = c1*ALPHA + c0
+*              with -ALPHA/2 < c0 <= ALPHA/2 except c1 = (Q-1)/ALPHA where we
+*              set c1 = 0 and -ALPHA/2 <= c0 = c mod Q - Q < 0.
+*              Assumes coefficients to be standard representatives.
+*
+* Arguments:   - poly *a1: pointer to output polynomial with coefficients c1
+*              - poly *a0: pointer to output polynomial with coefficients c0
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+void poly_decompose(poly *a1, poly *a0, const poly *a) {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N; ++i) {
+        a1->coeffs[i] = decompose(&a0->coeffs[i], a->coeffs[i]);
+    }
+
+    DBENCH_STOP(*tround);
+}
+
+/*************************************************
+* Name:        poly_make_hint
+*
+* Description: Compute hint polynomial. The coefficients of which indicate
+*              whether the low bits of the corresponding coefficient of
+*              the input polynomial overflow into the high bits.
+*
+* Arguments:   - poly *h: pointer to output hint polynomial
+*              - const poly *a0: pointer to low part of input polynomial
+*              - const poly *a1: pointer to high part of input polynomial
+*
+* Returns number of 1 bits.
+**************************************************/
+unsigned int poly_make_hint(poly *h, const poly *a0, const poly *a1) {
+    unsigned int i, s = 0;
+    DBENCH_START();
+
+    for (i = 0; i < N; ++i) {
+        h->coeffs[i] = make_hint(a0->coeffs[i], a1->coeffs[i]);
+        s += h->coeffs[i];
+    }
+
+    DBENCH_STOP(*tround);
+    return s;
+}
+
+/*************************************************
+* Name:        poly_use_hint
+*
+* Description: Use hint polynomial to correct the high bits of a polynomial.
+*
+* Arguments:   - poly *b: pointer to output polynomial with corrected high bits
+*              - const poly *a: pointer to input polynomial
+*              - const poly *h: pointer to input hint polynomial
+**************************************************/
+void poly_use_hint(poly *b, const poly *a, const poly *h) {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N; ++i) {
+        b->coeffs[i] = use_hint(a->coeffs[i], h->coeffs[i]);
+    }
+
+    DBENCH_STOP(*tround);
+}
+
+/*************************************************
+* Name:        poly_chknorm
+*
+* Description: Check infinity norm of polynomial against given bound.
+*              Assumes input coefficients were reduced by reduce32().
+*
+* Arguments:   - const poly *a: pointer to polynomial
+*              - int32_t B: norm bound
+*
+* Returns 0 if norm is strictly smaller than B <= (Q-1)/8 and 1 otherwise.
+**************************************************/
+int poly_chknorm(const poly *a, int32_t B) {
+    unsigned int i;
+    int32_t t;
+    DBENCH_START();
+
+    if (B > (DILITHIUM_Q - 1) / 8) {
+        return 1;
+    }
+
+    /* It is ok to leak which coefficient violates the bound since
+       the probability for each coefficient is independent of secret
+       data but we must not leak the sign of the centralized representative. */
+    for (i = 0; i < N; ++i) {
+        /* Absolute value */
+        t = a->coeffs[i] >> 31;
+        t = a->coeffs[i] - (t & 2 * a->coeffs[i]);
+
+        if (t >= B) {
+            DBENCH_STOP(*tsample);
+            return 1;
+        }
+    }
+
+    DBENCH_STOP(*tsample);
+    return 0;
+}
+
+/*************************************************
+* Name:        rej_uniform
+*
+* Description: Sample uniformly random coefficients in [0, Q-1] by
+*              performing rejection sampling on array of random bytes.
+*
+* Arguments:   - int32_t *a: pointer to output array (allocated)
+*              - unsigned int len: number of coefficients to be sampled
+*              - const uint8_t *buf: array of random bytes
+*              - unsigned int buflen: length of array of random bytes
+*
+* Returns number of sampled coefficients. Can be smaller than len if not enough
+* random bytes were given.
+**************************************************/
+static unsigned int rej_uniform(int32_t *a,
+                                unsigned int len,
+                                const uint8_t *buf,
+                                unsigned int buflen) {
+    unsigned int ctr, pos;
+    uint32_t t;
+    DBENCH_START();
+
+    ctr = pos = 0;
+    while (ctr < len && pos + 3 <= buflen) {
+        t  = buf[pos++];
+        t |= (uint32_t)buf[pos++] << 8;
+        t |= (uint32_t)buf[pos++] << 16;
+        t &= 0x7FFFFF;
+
+        if (t < DILITHIUM_Q) {
+            a[ctr++] = t;
+        }
+    }
+
+    DBENCH_STOP(*tsample);
+    return ctr;
+}
+
+/*************************************************
+* Name:        poly_uniform
+*
+* Description: Sample polynomial with uniformly random coefficients
+*              in [0,Q-1] by performing rejection sampling on the
+*              output stream of SHAKE256(seed|nonce) or AES256CTR(seed,nonce).
+*
+* Arguments:   - poly *a: pointer to output polynomial
+*              - const uint8_t seed[]: byte array with seed of length SEEDBYTES
+*              - uint16_t nonce: 2-byte nonce
+**************************************************/
+
+#define POLY_UNIFORM_NBLOCKS ((768 + STREAM128_BLOCKBYTES - 1)/STREAM128_BLOCKBYTES)
+void poly_uniform(poly *a,
+                  const uint8_t seed[SEEDBYTES],
+                  uint16_t nonce) {
+    unsigned int i, ctr, off;
+    unsigned int buflen = POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES;
+    uint8_t buf[POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES + 2];
+    stream128_state state;
+
+    stream128_init(&state, seed, nonce);
+    stream128_squeezeblocks(buf, POLY_UNIFORM_NBLOCKS, &state);
+
+    ctr = rej_uniform(a->coeffs, N, buf, buflen);
+
+    while (ctr < N) {
+        off = buflen % 3;
+        for (i = 0; i < off; ++i) {
+            buf[i] = buf[buflen - off + i];
+        }
+
+        stream128_squeezeblocks(buf + off, 1, &state);
+        buflen = STREAM128_BLOCKBYTES + off;
+        ctr += rej_uniform(a->coeffs + ctr, N - ctr, buf, buflen);
+    }
+    stream128_release(&state);
+}
+
+void poly_uniformx2(poly *a0, poly *a1,
+                    const uint8_t seed[SEEDBYTES],
+                    uint16_t nonce0, uint16_t nonce1) {
+    unsigned int ctr0, ctr1;
+    unsigned int buflen = POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES;
+    uint8_t buf0[POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES + 2];
+    uint8_t buf1[POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES + 2];
+
+    keccakx2_state statex2;
+    dilithium_shake128x2_stream_init(&statex2, seed, nonce0, nonce1);
+    shake128x2_squeezeblocks(buf0, buf1, POLY_UNIFORM_NBLOCKS, &statex2);
+
+    ctr0 = rej_uniform(a0->coeffs, N, buf0, buflen);
+    ctr1 = rej_uniform(a1->coeffs, N, buf1, buflen);
+
+    while (ctr0 < N || ctr1 < N) {
+        shake128x2_squeezeblocks(buf0, buf1, 1, &statex2);
+        ctr0 += rej_uniform(a0->coeffs + ctr0, N - ctr0, buf0, buflen);
+        ctr1 += rej_uniform(a1->coeffs + ctr1, N - ctr1, buf1, buflen);
+    }
+
+
+}
+
+/*************************************************
+* Name:        rej_eta
+*
+* Description: Sample uniformly random coefficients in [-ETA, ETA] by
+*              performing rejection sampling on array of random bytes.
+*
+* Arguments:   - int32_t *a: pointer to output array (allocated)
+*              - unsigned int len: number of coefficients to be sampled
+*              - const uint8_t *buf: array of random bytes
+*              - unsigned int buflen: length of array of random bytes
+*
+* Returns number of sampled coefficients. Can be smaller than len if not enough
+* random bytes were given.
+**************************************************/
+static unsigned int rej_eta(int32_t *a,
+                            unsigned int len,
+                            const uint8_t *buf,
+                            unsigned int buflen) {
+    unsigned int ctr, pos;
+    uint32_t t0, t1;
+    DBENCH_START();
+
+    ctr = pos = 0;
+    while (ctr < len && pos < buflen) {
+        t0 = buf[pos] & 0x0F;
+        t1 = buf[pos++] >> 4;
+
+
+        if (t0 < 9) {
+            a[ctr++] = 4 - t0;
+        }
+        if (t1 < 9 && ctr < len) {
+            a[ctr++] = 4 - t1;
+        }
+
+
+
+    }
+
+    DBENCH_STOP(*tsample);
+    return ctr;
+}
+
+/*************************************************
+* Name:        poly_uniform_eta
+*
+* Description: Sample polynomial with uniformly random coefficients
+*              in [-ETA,ETA] by performing rejection sampling on the
+*              output stream from SHAKE256(seed|nonce) or AES256CTR(seed,nonce).
+*
+* Arguments:   - poly *a: pointer to output polynomial
+*              - const uint8_t seed[]: byte array with seed of length CRHBYTES
+*              - uint16_t nonce: 2-byte nonce
+**************************************************/
+#define POLY_UNIFORM_ETA_NBLOCKS ((227 + STREAM256_BLOCKBYTES - 1)/STREAM256_BLOCKBYTES)
+void poly_uniform_eta(poly *a,
+                      const uint8_t seed[CRHBYTES],
+                      uint16_t nonce) {
+    unsigned int ctr;
+    unsigned int buflen = POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES;
+    uint8_t buf[POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES];
+    stream256_state state;
+
+    stream256_init(&state, seed, nonce);
+    stream256_squeezeblocks(buf, POLY_UNIFORM_ETA_NBLOCKS, &state);
+
+    ctr = rej_eta(a->coeffs, N, buf, buflen);
+
+    while (ctr < N) {
+        stream256_squeezeblocks(buf, 1, &state);
+        ctr += rej_eta(a->coeffs + ctr, N - ctr, buf, STREAM256_BLOCKBYTES);
+    }
+    stream256_release(&state);
+}
+
+void poly_uniform_etax2(poly *a0, poly *a1,
+                        const uint8_t seed[CRHBYTES],
+                        uint16_t nonce0, uint16_t nonce1) {
+    unsigned int ctr0, ctr1;
+    unsigned int buflen = POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES;
+
+    uint8_t buf0[POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES];
+    uint8_t buf1[POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES];
+
+    keccakx2_state statex2;
+
+    dilithium_shake256x2_stream_init(&statex2, seed, nonce0, nonce1);
+    shake256x2_squeezeblocks(buf0, buf1, POLY_UNIFORM_ETA_NBLOCKS, &statex2);
+
+    ctr0 = rej_eta(a0->coeffs, N, buf0, buflen);
+    ctr1 = rej_eta(a1->coeffs, N, buf1, buflen);
+
+    while (ctr0 < N || ctr1 < N) {
+        shake256x2_squeezeblocks(buf0, buf1, 1, &statex2);
+        ctr0 += rej_eta(a0->coeffs + ctr0, N - ctr0, buf0, STREAM256_BLOCKBYTES);
+        ctr1 += rej_eta(a1->coeffs + ctr1, N - ctr1, buf1, STREAM256_BLOCKBYTES);
+    }
+}
+
+/*************************************************
+* Name:        poly_uniform_gamma1m1
+*
+* Description: Sample polynomial with uniformly random coefficients
+*              in [-(GAMMA1 - 1), GAMMA1] by unpacking output stream
+*              of SHAKE256(seed|nonce) or AES256CTR(seed,nonce).
+*
+* Arguments:   - poly *a: pointer to output polynomial
+*              - const uint8_t seed[]: byte array with seed of length CRHBYTES
+*              - uint16_t nonce: 16-bit nonce
+**************************************************/
+#define POLY_UNIFORM_GAMMA1_NBLOCKS ((POLYZ_PACKEDBYTES + STREAM256_BLOCKBYTES - 1)/STREAM256_BLOCKBYTES)
+void poly_uniform_gamma1(poly *a,
+                         const uint8_t seed[CRHBYTES],
+                         uint16_t nonce) {
+    uint8_t buf[POLY_UNIFORM_GAMMA1_NBLOCKS * STREAM256_BLOCKBYTES];
+    stream256_state state;
+
+    stream256_init(&state, seed, nonce);
+    stream256_squeezeblocks(buf, POLY_UNIFORM_GAMMA1_NBLOCKS, &state);
+    stream256_release(&state);
+    polyz_unpack(a, buf);
+}
+
+void poly_uniform_gamma1x2(poly *a0, poly *a1,
+                           const uint8_t seed[CRHBYTES],
+                           uint16_t nonce0, uint16_t nonce1) {
+
+    uint8_t buf0[POLY_UNIFORM_GAMMA1_NBLOCKS * STREAM256_BLOCKBYTES];
+    uint8_t buf1[POLY_UNIFORM_GAMMA1_NBLOCKS * STREAM256_BLOCKBYTES];
+
+    keccakx2_state statex2;
+
+    dilithium_shake256x2_stream_init(&statex2, seed, nonce0, nonce1);
+    shake256x2_squeezeblocks(buf0, buf1, POLY_UNIFORM_GAMMA1_NBLOCKS, &statex2);
+
+    polyz_unpack(a0, buf0);
+    polyz_unpack(a1, buf1);
+
+}
+
+/*************************************************
+* Name:        challenge
+*
+* Description: Implementation of H. Samples polynomial with TAU nonzero
+*              coefficients in {-1,1} using the output stream of
+*              SHAKE256(seed).
+*
+* Arguments:   - poly *c: pointer to output polynomial
+*              - const uint8_t mu[]: byte array containing seed of length SEEDBYTES
+**************************************************/
+void poly_challenge(poly *c, const uint8_t seed[SEEDBYTES]) {
+    unsigned int i, b, pos;
+    uint64_t signs;
+    uint8_t buf[SHAKE256_RATE];
+    shake256incctx state;
+
+    shake256_inc_init(&state);
+    shake256_inc_absorb(&state, seed, SEEDBYTES);
+    shake256_inc_finalize(&state);
+    shake256_inc_squeeze(buf, sizeof buf, &state);
+
+    signs = 0;
+    for (i = 0; i < 8; ++i) {
+        signs |= (uint64_t)buf[i] << 8 * i;
+    }
+    pos = 8;
+
+    for (i = 0; i < N; ++i) {
+        c->coeffs[i] = 0;
+    }
+    for (i = N - TAU; i < N; ++i) {
+        do {
+            if (pos >= SHAKE256_RATE) {
+                shake256_inc_squeeze(buf, sizeof buf, &state);
+                pos = 0;
+            }
+
+            b = buf[pos++];
+        } while (b > i);
+
+        c->coeffs[i] = c->coeffs[b];
+        c->coeffs[b] = 1 - 2 * (signs & 1);
+        signs >>= 1;
+    }
+    shake256_inc_ctx_release(&state);
+}
+
+/*************************************************
+* Name:        polyeta_pack
+*
+* Description: Bit-pack polynomial with coefficients in [-ETA,ETA].
+*
+* Arguments:   - uint8_t *r: pointer to output byte array with at least
+*                            POLYETA_PACKEDBYTES bytes
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+void polyeta_pack(uint8_t *r, const poly *a) {
+    unsigned int i;
+    uint8_t t[8];
+    DBENCH_START();
+
+
+    for (i = 0; i < N / 2; ++i) {
+        t[0] = ETA - a->coeffs[2 * i + 0];
+        t[1] = ETA - a->coeffs[2 * i + 1];
+        r[i] = t[0] | (t[1] << 4);
+    }
+
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyeta_unpack
+*
+* Description: Unpack polynomial with coefficients in [-ETA,ETA].
+*
+* Arguments:   - poly *r: pointer to output polynomial
+*              - const uint8_t *a: byte array with bit-packed polynomial
+**************************************************/
+void polyeta_unpack(poly *r, const uint8_t *a) {
+    unsigned int i;
+    DBENCH_START();
+
+
+    for (i = 0; i < N / 2; ++i) {
+        r->coeffs[2 * i + 0] = a[i] & 0x0F;
+        r->coeffs[2 * i + 1] = a[i] >> 4;
+        r->coeffs[2 * i + 0] = ETA - r->coeffs[2 * i + 0];
+        r->coeffs[2 * i + 1] = ETA - r->coeffs[2 * i + 1];
+    }
+
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyt1_pack
+*
+* Description: Bit-pack polynomial t1 with coefficients fitting in 10 bits.
+*              Input coefficients are assumed to be standard representatives.
+*
+* Arguments:   - uint8_t *r: pointer to output byte array with at least
+*                            POLYT1_PACKEDBYTES bytes
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+void polyt1_pack(uint8_t *r, const poly *a) {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N / 4; ++i) {
+        r[5 * i + 0] = (uint8_t) (a->coeffs[4 * i + 0] >> 0);
+        r[5 * i + 1] = (uint8_t) ((a->coeffs[4 * i + 0] >> 8) | (a->coeffs[4 * i + 1] << 2));
+        r[5 * i + 2] = (uint8_t) ((a->coeffs[4 * i + 1] >> 6) | (a->coeffs[4 * i + 2] << 4));
+        r[5 * i + 3] = (uint8_t) ((a->coeffs[4 * i + 2] >> 4) | (a->coeffs[4 * i + 3] << 6));
+        r[5 * i + 4] = (uint8_t) (a->coeffs[4 * i + 3] >> 2);
+    }
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyt1_unpack
+*
+* Description: Unpack polynomial t1 with 10-bit coefficients.
+*              Output coefficients are standard representatives.
+*
+* Arguments:   - poly *r: pointer to output polynomial
+*              - const uint8_t *a: byte array with bit-packed polynomial
+**************************************************/
+extern void PQCLEAN_DILITHIUM3_AARCH64_asm_10_to_32(int32_t *, const uint8_t *);
+void polyt1_unpack(poly *r, const uint8_t *a) {
+    DBENCH_START();
+
+    PQCLEAN_DILITHIUM3_AARCH64_asm_10_to_32(r->coeffs, a);
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyt0_pack
+*
+* Description: Bit-pack polynomial t0 with coefficients in ]-2^{D-1}, 2^{D-1}].
+*
+* Arguments:   - uint8_t *r: pointer to output byte array with at least
+*                            POLYT0_PACKEDBYTES bytes
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+void polyt0_pack(uint8_t *r, const poly *a) {
+    unsigned int i;
+    uint32_t t[8];
+    DBENCH_START();
+
+    for (i = 0; i < N / 8; ++i) {
+        t[0] = (1 << (D - 1)) - a->coeffs[8 * i + 0];
+        t[1] = (1 << (D - 1)) - a->coeffs[8 * i + 1];
+        t[2] = (1 << (D - 1)) - a->coeffs[8 * i + 2];
+        t[3] = (1 << (D - 1)) - a->coeffs[8 * i + 3];
+        t[4] = (1 << (D - 1)) - a->coeffs[8 * i + 4];
+        t[5] = (1 << (D - 1)) - a->coeffs[8 * i + 5];
+        t[6] = (1 << (D - 1)) - a->coeffs[8 * i + 6];
+        t[7] = (1 << (D - 1)) - a->coeffs[8 * i + 7];
+
+        r[13 * i + 0]  =  (uint8_t) t[0];
+        r[13 * i + 1]  =  (uint8_t) (t[0] >>  8);
+        r[13 * i + 1] |=  (uint8_t) (t[1] <<  5);
+        r[13 * i + 2]  =  (uint8_t) (t[1] >>  3);
+        r[13 * i + 3]  =  (uint8_t) (t[1] >> 11);
+        r[13 * i + 3] |=  (uint8_t) (t[2] <<  2);
+        r[13 * i + 4]  =  (uint8_t) (t[2] >>  6);
+        r[13 * i + 4] |=  (uint8_t) (t[3] <<  7);
+        r[13 * i + 5]  =  (uint8_t) (t[3] >>  1);
+        r[13 * i + 6]  =  (uint8_t) (t[3] >>  9);
+        r[13 * i + 6] |=  (uint8_t) (t[4] <<  4);
+        r[13 * i + 7]  =  (uint8_t) (t[4] >>  4);
+        r[13 * i + 8]  =  (uint8_t) (t[4] >> 12);
+        r[13 * i + 8] |=  (uint8_t) (t[5] <<  1);
+        r[13 * i + 9]  =  (uint8_t) (t[5] >>  7);
+        r[13 * i + 9] |=  (uint8_t) (t[6] <<  6);
+        r[13 * i + 10]  =  (uint8_t) (t[6] >>  2);
+        r[13 * i + 11]  =  (uint8_t) (t[6] >> 10);
+        r[13 * i + 11] |=  (uint8_t) (t[7] <<  3);
+        r[13 * i + 12]  =  (uint8_t) (t[7] >>  5);
+    }
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyt0_unpack
+*
+* Description: Unpack polynomial t0 with coefficients in ]-2^{D-1}, 2^{D-1}].
+*
+* Arguments:   - poly *r: pointer to output polynomial
+*              - const uint8_t *a: byte array with bit-packed polynomial
+**************************************************/
+void polyt0_unpack(poly *r, const uint8_t *a) {
+    unsigned int i;
+    DBENCH_START();
+
+    for (i = 0; i < N / 8; ++i) {
+        r->coeffs[8 * i + 0]  = a[13 * i + 0];
+        r->coeffs[8 * i + 0] |= (uint32_t)a[13 * i + 1] << 8;
+        r->coeffs[8 * i + 0] &= 0x1FFF;
+
+        r->coeffs[8 * i + 1]  = a[13 * i + 1] >> 5;
+        r->coeffs[8 * i + 1] |= (uint32_t)a[13 * i + 2] << 3;
+        r->coeffs[8 * i + 1] |= (uint32_t)a[13 * i + 3] << 11;
+        r->coeffs[8 * i + 1] &= 0x1FFF;
+
+        r->coeffs[8 * i + 2]  = a[13 * i + 3] >> 2;
+        r->coeffs[8 * i + 2] |= (uint32_t)a[13 * i + 4] << 6;
+        r->coeffs[8 * i + 2] &= 0x1FFF;
+
+        r->coeffs[8 * i + 3]  = a[13 * i + 4] >> 7;
+        r->coeffs[8 * i + 3] |= (uint32_t)a[13 * i + 5] << 1;
+        r->coeffs[8 * i + 3] |= (uint32_t)a[13 * i + 6] << 9;
+        r->coeffs[8 * i + 3] &= 0x1FFF;
+
+        r->coeffs[8 * i + 4]  = a[13 * i + 6] >> 4;
+        r->coeffs[8 * i + 4] |= (uint32_t)a[13 * i + 7] << 4;
+        r->coeffs[8 * i + 4] |= (uint32_t)a[13 * i + 8] << 12;
+        r->coeffs[8 * i + 4] &= 0x1FFF;
+
+        r->coeffs[8 * i + 5]  = a[13 * i + 8] >> 1;
+        r->coeffs[8 * i + 5] |= (uint32_t)a[13 * i + 9] << 7;
+        r->coeffs[8 * i + 5] &= 0x1FFF;
+
+        r->coeffs[8 * i + 6]  = a[13 * i + 9] >> 6;
+        r->coeffs[8 * i + 6] |= (uint32_t)a[13 * i + 10] << 2;
+        r->coeffs[8 * i + 6] |= (uint32_t)a[13 * i + 11] << 10;
+        r->coeffs[8 * i + 6] &= 0x1FFF;
+
+        r->coeffs[8 * i + 7]  = a[13 * i + 11] >> 3;
+        r->coeffs[8 * i + 7] |= (uint32_t)a[13 * i + 12] << 5;
+        r->coeffs[8 * i + 7] &= 0x1FFF;
+
+        r->coeffs[8 * i + 0] = (1 << (D - 1)) - r->coeffs[8 * i + 0];
+        r->coeffs[8 * i + 1] = (1 << (D - 1)) - r->coeffs[8 * i + 1];
+        r->coeffs[8 * i + 2] = (1 << (D - 1)) - r->coeffs[8 * i + 2];
+        r->coeffs[8 * i + 3] = (1 << (D - 1)) - r->coeffs[8 * i + 3];
+        r->coeffs[8 * i + 4] = (1 << (D - 1)) - r->coeffs[8 * i + 4];
+        r->coeffs[8 * i + 5] = (1 << (D - 1)) - r->coeffs[8 * i + 5];
+        r->coeffs[8 * i + 6] = (1 << (D - 1)) - r->coeffs[8 * i + 6];
+        r->coeffs[8 * i + 7] = (1 << (D - 1)) - r->coeffs[8 * i + 7];
+    }
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyz_pack
+*
+* Description: Bit-pack polynomial with coefficients
+*              in [-(GAMMA1 - 1), GAMMA1].
+*
+* Arguments:   - uint8_t *r: pointer to output byte array with at least
+*                            POLYZ_PACKEDBYTES bytes
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+void polyz_pack(uint8_t *r, const poly *a) {
+    unsigned int i;
+    uint32_t t[4];
+    DBENCH_START();
+
+
+    for (i = 0; i < N / 2; ++i) {
+        t[0] = GAMMA1 - a->coeffs[2 * i + 0];
+        t[1] = GAMMA1 - a->coeffs[2 * i + 1];
+
+        r[5 * i + 0]  = t[0];
+        r[5 * i + 1]  = t[0] >> 8;
+        r[5 * i + 2]  = t[0] >> 16;
+        r[5 * i + 2] |= t[1] << 4;
+        r[5 * i + 3]  = t[1] >> 4;
+        r[5 * i + 4]  = t[1] >> 12;
+    }
+
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyz_unpack
+*
+* Description: Unpack polynomial z with coefficients
+*              in [-(GAMMA1 - 1), GAMMA1].
+*
+* Arguments:   - poly *r: pointer to output polynomial
+*              - const uint8_t *a: byte array with bit-packed polynomial
+**************************************************/
+void polyz_unpack(poly *r, const uint8_t *a) {
+    unsigned int i;
+    DBENCH_START();
+
+
+    for (i = 0; i < N / 2; ++i) {
+        r->coeffs[2 * i + 0]  = a[5 * i + 0];
+        r->coeffs[2 * i + 0] |= (uint32_t)a[5 * i + 1] << 8;
+        r->coeffs[2 * i + 0] |= (uint32_t)a[5 * i + 2] << 16;
+        r->coeffs[2 * i + 0] &= 0xFFFFF;
+
+        r->coeffs[2 * i + 1]  = a[5 * i + 2] >> 4;
+        r->coeffs[2 * i + 1] |= (uint32_t)a[5 * i + 3] << 4;
+        r->coeffs[2 * i + 1] |= (uint32_t)a[5 * i + 4] << 12;
+        r->coeffs[2 * i + 0] &= 0xFFFFF;
+
+        r->coeffs[2 * i + 0] = GAMMA1 - r->coeffs[2 * i + 0];
+        r->coeffs[2 * i + 1] = GAMMA1 - r->coeffs[2 * i + 1];
+    }
+
+
+    DBENCH_STOP(*tpack);
+}
+
+/*************************************************
+* Name:        polyw1_pack
+*
+* Description: Bit-pack polynomial w1 with coefficients in [0,15] or [0,43].
+*              Input coefficients are assumed to be standard representatives.
+*
+* Arguments:   - uint8_t *r: pointer to output byte array with at least
+*                            POLYW1_PACKEDBYTES bytes
+*              - const poly *a: pointer to input polynomial
+**************************************************/
+void polyw1_pack(uint8_t *r, const poly *a) {
+    unsigned int i;
+    DBENCH_START();
+
+
+    for (i = 0; i < N / 2; ++i) {
+        r[i] = a->coeffs[2 * i + 0] | (a->coeffs[2 * i + 1] << 4);
+    }
+
+
+    DBENCH_STOP(*tpack);
+}

src/sign/dilithium/dilithium3/aarch64/poly.h

@@ -0,0 +1,92 @@
+#ifndef POLY_H
+#define POLY_H
+#include "params.h"
+#include <stdint.h>
+
+typedef struct {
+    int32_t coeffs[N];
+} poly;
+
+#define poly_reduce DILITHIUM_NAMESPACE(poly_reduce)
+void poly_reduce(poly *a);
+#define poly_caddq DILITHIUM_NAMESPACE(poly_caddq)
+void poly_caddq(poly *a);
+#define poly_freeze DILITHIUM_NAMESPACE(poly_freeze)
+void poly_freeze(poly *a);
+
+#define poly_add DILITHIUM_NAMESPACE(poly_add)
+void poly_add(poly *c, const poly *a, const poly *b);
+#define poly_sub DILITHIUM_NAMESPACE(poly_sub)
+void poly_sub(poly *c, const poly *a, const poly *b);
+#define poly_shiftl DILITHIUM_NAMESPACE(poly_shiftl)
+void poly_shiftl(poly *a);
+
+#define poly_ntt DILITHIUM_NAMESPACE(poly_ntt)
+void poly_ntt(poly *a);
+#define poly_invntt_tomont DILITHIUM_NAMESPACE(poly_invntt_tomont)
+void poly_invntt_tomont(poly *a);
+#define poly_pointwise_montgomery DILITHIUM_NAMESPACE(poly_pointwise_montgomery)
+void poly_pointwise_montgomery(poly *c, const poly *a, const poly *b);
+
+#define poly_power2round DILITHIUM_NAMESPACE(poly_power2round)
+void poly_power2round(poly *a1, poly *a0, const poly *a);
+#define poly_decompose DILITHIUM_NAMESPACE(poly_decompose)
+void poly_decompose(poly *a1, poly *a0, const poly *a);
+#define poly_make_hint DILITHIUM_NAMESPACE(poly_make_hint)
+unsigned int poly_make_hint(poly *h, const poly *a0, const poly *a1);
+#define poly_use_hint DILITHIUM_NAMESPACE(poly_use_hint)
+void poly_use_hint(poly *b, const poly *a, const poly *h);
+
+#define poly_chknorm DILITHIUM_NAMESPACE(poly_chknorm)
+int poly_chknorm(const poly *a, int32_t B);
+#define poly_uniform DILITHIUM_NAMESPACE(poly_uniform)
+void poly_uniform(poly *a,
+                  const uint8_t seed[SEEDBYTES],
+                  uint16_t nonce);
+#define poly_uniformx2 DILITHIUM_NAMESPACE(poly_uniformx2)
+void poly_uniformx2(poly *a0, poly *a1,
+                    const uint8_t seed[SEEDBYTES],
+                    uint16_t nonce0, uint16_t nonce1);
+#define poly_uniform_eta DILITHIUM_NAMESPACE(poly_uniform_eta)
+void poly_uniform_eta(poly *a,
+                      const uint8_t seed[CRHBYTES],
+                      uint16_t nonce);
+#define poly_uniform_etax2 DILITHIUM_NAMESPACE(poly_uniform_etax2)
+void poly_uniform_etax2(poly *a0, poly *a1,
+                        const uint8_t seed[CRHBYTES],
+                        uint16_t nonce0, uint16_t nonce1);
+#define poly_uniform_gamma1 DILITHIUM_NAMESPACE(poly_uniform_gamma1)
+void poly_uniform_gamma1(poly *a,
+                         const uint8_t seed[CRHBYTES],
+                         uint16_t nonce);
+#define poly_uniform_gamma1x2 DILITHIUM_NAMESPACE(poly_uniform_gamma1x2)
+void poly_uniform_gamma1x2(poly *a0, poly *a1,
+                           const uint8_t seed[CRHBYTES],
+                           uint16_t nonce0, uint16_t nonce1);
+#define poly_challenge DILITHIUM_NAMESPACE(poly_challenge)
+void poly_challenge(poly *c, const uint8_t seed[SEEDBYTES]);
+
+#define polyeta_pack DILITHIUM_NAMESPACE(polyeta_pack)
+void polyeta_pack(uint8_t *r, const poly *a);
+#define polyeta_unpack DILITHIUM_NAMESPACE(polyeta_unpack)
+void polyeta_unpack(poly *r, const uint8_t *a);
+
+#define polyt1_pack DILITHIUM_NAMESPACE(polyt1_pack)
+void polyt1_pack(uint8_t *r, const poly *a);
+#define polyt1_unpack DILITHIUM_NAMESPACE(polyt1_unpack)
+void polyt1_unpack(poly *r, const uint8_t *a);
+
+#define polyt0_pack DILITHIUM_NAMESPACE(polyt0_pack)
+void polyt0_pack(uint8_t *r, const poly *a);
+#define polyt0_unpack DILITHIUM_NAMESPACE(polyt0_unpack)
+void polyt0_unpack(poly *r, const uint8_t *a);
+
+#define polyz_pack DILITHIUM_NAMESPACE(polyz_pack)
+void polyz_pack(uint8_t *r, const poly *a);
+#define polyz_unpack DILITHIUM_NAMESPACE(polyz_unpack)
+void polyz_unpack(poly *r, const uint8_t *a);
+
+#define polyw1_pack DILITHIUM_NAMESPACE(polyw1_pack)
+void polyw1_pack(uint8_t *r, const poly *a);
+
+#endif

src/sign/dilithium/dilithium3/aarch64/polyvec.c

@@ -0,0 +1,452 @@
+#include "params.h"
+#include "poly.h"
+#include "polyvec.h"
+#include <stdint.h>
+
+#include "reduce.h"
+
+static const int32_t l_montgomery_const[4] = {
+    DILITHIUM_Q, DILITHIUM_QINV
+};
+
+/*************************************************
+* Name:        expand_mat
+*
+* Description: Implementation of ExpandA. Generates matrix A with uniformly
+*              random coefficients a_{i,j} by performing rejection
+*              sampling on the output stream of SHAKE128(rho|j|i)
+*              or AES256CTR(rho,j|i).
+*
+* Arguments:   - polyvecl mat[K]: output matrix
+*              - const uint8_t rho[]: byte array containing seed rho
+**************************************************/
+void polyvec_matrix_expand(polyvecl mat[K], const uint8_t rho[SEEDBYTES]) {
+    unsigned int i, j;
+
+    for (j = 0; j < L; ++j) {
+        for (i = 0; i < K; i += 2) {
+            poly_uniformx2(&mat[i + 0].vec[j], &mat[i + 1].vec[j], rho, (uint16_t) ((i << 8) + j), (uint16_t) (((i + 1) << 8) + j));
+        }
+    }
+}
+
+void polyvec_matrix_pointwise_montgomery(polyveck *t, const polyvecl mat[K], const polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        polyvecl_pointwise_acc_montgomery(&t->vec[i], &mat[i], v);
+    }
+}
+
+/**************************************************************/
+/************ Vectors of polynomials of length L **************/
+/**************************************************************/
+
+void polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_uniform_eta(&v->vec[i], seed, nonce++);
+    }
+}
+
+void polyvecl_uniform_gamma1(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
+    unsigned int i;
+
+    for (i = 0; i < L - 1; i += 2) {
+        poly_uniform_gamma1x2(&v->vec[i + 0], &v->vec[i + 1], seed, (uint16_t) (L * nonce + i + 0), (uint16_t) (L * nonce + i + 1));
+    }
+    if (L & 1) {
+        poly_uniform_gamma1(&v->vec[i], seed, (uint16_t) (L * nonce + L - 1));
+    }
+}
+
+void polyvecl_reduce(polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_reduce(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyvecl_freeze
+*
+* Description: Reduce coefficients of polynomials in vector of length L
+*              to standard representatives.
+*
+* Arguments:   - polyvecl *v: pointer to input/output vector
+**************************************************/
+void polyvecl_freeze(polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_freeze(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyvecl_add
+*
+* Description: Add vectors of polynomials of length L.
+*              No modular reduction is performed.
+*
+* Arguments:   - polyvecl *w: pointer to output vector
+*              - const polyvecl *u: pointer to first summand
+*              - const polyvecl *v: pointer to second summand
+**************************************************/
+void polyvecl_add(polyvecl *w, const polyvecl *u, const polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_add(&w->vec[i], &u->vec[i], &v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyvecl_ntt
+*
+* Description: Forward NTT of all polynomials in vector of length L. Output
+*              coefficients can be up to 16*Q larger than input coefficients.
+*
+* Arguments:   - polyvecl *v: pointer to input/output vector
+**************************************************/
+void polyvecl_ntt(polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_ntt(&v->vec[i]);
+    }
+}
+
+void polyvecl_invntt_tomont(polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_invntt_tomont(&v->vec[i]);
+    }
+}
+
+void polyvecl_pointwise_poly_montgomery(polyvecl *r, const poly *a, const polyvecl *v) {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        poly_pointwise_montgomery(&r->vec[i], a, &v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyvecl_pointwise_acc_montgomery
+*
+* Description: Pointwise multiply vectors of polynomials of length L, multiply
+*              resulting vector by 2^{-32} and add (accumulate) polynomials
+*              in it. Input/output vectors are in NTT domain representation.
+*
+* Arguments:   - poly *w: output polynomial
+*              - const polyvecl *u: pointer to first input vector
+*              - const polyvecl *v: pointer to second input vector
+**************************************************/
+extern void PQCLEAN_DILITHIUM3_AARCH64_asm_polyvecl_pointwise_acc_montgomery(int32_t *, const int32_t *, const int32_t *, const int32_t *);
+void polyvecl_pointwise_acc_montgomery(poly *w,
+                                       const polyvecl *u,
+                                       const polyvecl *v) {
+    PQCLEAN_DILITHIUM3_AARCH64_asm_polyvecl_pointwise_acc_montgomery(w->coeffs, u->vec[0].coeffs, v->vec[0].coeffs, l_montgomery_const);
+}
+
+/*************************************************
+* Name:        polyvecl_chknorm
+*
+* Description: Check infinity norm of polynomials in vector of length L.
+*              Assumes input polyvecl to be reduced by polyvecl_reduce().
+*
+* Arguments:   - const polyvecl *v: pointer to vector
+*              - int32_t B: norm bound
+*
+* Returns 0 if norm of all polynomials is strictly smaller than B <= (Q-1)/8
+* and 1 otherwise.
+**************************************************/
+int polyvecl_chknorm(const polyvecl *v, int32_t bound)  {
+    unsigned int i;
+
+    for (i = 0; i < L; ++i) {
+        if (poly_chknorm(&v->vec[i], bound)) {
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
+/**************************************************************/
+/************ Vectors of polynomials of length K **************/
+/**************************************************************/
+
+void polyveck_uniform_eta(polyveck *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_uniform_eta(&v->vec[i], seed, nonce++);
+    }
+
+}
+
+/*************************************************
+* Name:        polyveck_reduce
+*
+* Description: Reduce coefficients of polynomials in vector of length K
+*              to representatives in [-6283009,6283007].
+*
+* Arguments:   - polyveck *v: pointer to input/output vector
+**************************************************/
+void polyveck_reduce(polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_reduce(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_caddq
+*
+* Description: For all coefficients of polynomials in vector of length K
+*              add Q if coefficient is negative.
+*
+* Arguments:   - polyveck *v: pointer to input/output vector
+**************************************************/
+void polyveck_caddq(polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_caddq(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_freeze
+*
+* Description: Reduce coefficients of polynomials in vector of length K
+*              to standard representatives.
+*
+* Arguments:   - polyveck *v: pointer to input/output vector
+**************************************************/
+void polyveck_freeze(polyveck *v)  {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_freeze(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_add
+*
+* Description: Add vectors of polynomials of length K.
+*              No modular reduction is performed.
+*
+* Arguments:   - polyveck *w: pointer to output vector
+*              - const polyveck *u: pointer to first summand
+*              - const polyveck *v: pointer to second summand
+**************************************************/
+void polyveck_add(polyveck *w, const polyveck *u, const polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_add(&w->vec[i], &u->vec[i], &v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_sub
+*
+* Description: Subtract vectors of polynomials of length K.
+*              No modular reduction is performed.
+*
+* Arguments:   - polyveck *w: pointer to output vector
+*              - const polyveck *u: pointer to first input vector
+*              - const polyveck *v: pointer to second input vector to be
+*                                   subtracted from first input vector
+**************************************************/
+void polyveck_sub(polyveck *w, const polyveck *u, const polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_sub(&w->vec[i], &u->vec[i], &v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_shiftl
+*
+* Description: Multiply vector of polynomials of Length K by 2^D without modular
+*              reduction. Assumes input coefficients to be less than 2^{31-D}.
+*
+* Arguments:   - polyveck *v: pointer to input/output vector
+**************************************************/
+void polyveck_shiftl(polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_shiftl(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_ntt
+*
+* Description: Forward NTT of all polynomials in vector of length K. Output
+*              coefficients can be up to 16*Q larger than input coefficients.
+*
+* Arguments:   - polyveck *v: pointer to input/output vector
+**************************************************/
+void polyveck_ntt(polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_ntt(&v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_invntt_tomont
+*
+* Description: Inverse NTT and multiplication by 2^{32} of polynomials
+*              in vector of length K. Input coefficients need to be less
+*              than 2*Q.
+*
+* Arguments:   - polyveck *v: pointer to input/output vector
+**************************************************/
+void polyveck_invntt_tomont(polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_invntt_tomont(&v->vec[i]);
+    }
+}
+
+void polyveck_pointwise_poly_montgomery(polyveck *r, const poly *a, const polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_pointwise_montgomery(&r->vec[i], a, &v->vec[i]);
+    }
+}
+
+
+/*************************************************
+* Name:        polyveck_chknorm
+*
+* Description: Check infinity norm of polynomials in vector of length K.
+*              Assumes input polyveck to be reduced by polyveck_reduce().
+*
+* Arguments:   - const polyveck *v: pointer to vector
+*              - int32_t B: norm bound
+*
+* Returns 0 if norm of all polynomials are strictly smaller than B <= (Q-1)/8
+* and 1 otherwise.
+**************************************************/
+int polyveck_chknorm(const polyveck *v, int32_t bound) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        if (poly_chknorm(&v->vec[i], bound)) {
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
+/*************************************************
+* Name:        polyveck_power2round
+*
+* Description: For all coefficients a of polynomials in vector of length K,
+*              compute a0, a1 such that a mod^+ Q = a1*2^D + a0
+*              with -2^{D-1} < a0 <= 2^{D-1}. Assumes coefficients to be
+*              standard representatives.
+*
+* Arguments:   - polyveck *v1: pointer to output vector of polynomials with
+*                              coefficients a1
+*              - polyveck *v0: pointer to output vector of polynomials with
+*                              coefficients a0
+*              - const polyveck *v: pointer to input vector
+**************************************************/
+void polyveck_power2round(polyveck *v1, polyveck *v0, const polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_power2round(&v1->vec[i], &v0->vec[i], &v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_decompose
+*
+* Description: For all coefficients a of polynomials in vector of length K,
+*              compute high and low bits a0, a1 such a mod^+ Q = a1*ALPHA + a0
+*              with -ALPHA/2 < a0 <= ALPHA/2 except a1 = (Q-1)/ALPHA where we
+*              set a1 = 0 and -ALPHA/2 <= a0 = a mod Q - Q < 0.
+*              Assumes coefficients to be standard representatives.
+*
+* Arguments:   - polyveck *v1: pointer to output vector of polynomials with
+*                              coefficients a1
+*              - polyveck *v0: pointer to output vector of polynomials with
+*                              coefficients a0
+*              - const polyveck *v: pointer to input vector
+**************************************************/
+void polyveck_decompose(polyveck *v1, polyveck *v0, const polyveck *v) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_decompose(&v1->vec[i], &v0->vec[i], &v->vec[i]);
+    }
+}
+
+/*************************************************
+* Name:        polyveck_make_hint
+*
+* Description: Compute hint vector.
+*
+* Arguments:   - polyveck *h: pointer to output vector
+*              - const polyveck *v0: pointer to low part of input vector
+*              - const polyveck *v1: pointer to high part of input vector
+*
+* Returns number of 1 bits.
+**************************************************/
+unsigned int polyveck_make_hint(polyveck *h,
+                                const polyveck *v0,
+                                const polyveck *v1) {
+    unsigned int i, s = 0;
+
+    for (i = 0; i < K; ++i) {
+        s += poly_make_hint(&h->vec[i], &v0->vec[i], &v1->vec[i]);
+    }
+
+    return s;
+}
+
+/*************************************************
+* Name:        polyveck_use_hint
+*
+* Description: Use hint vector to correct the high bits of input vector.
+*
+* Arguments:   - polyveck *w: pointer to output vector of polynomials with
+*                             corrected high bits
+*              - const polyveck *u: pointer to input vector
+*              - const polyveck *h: pointer to input hint vector
+**************************************************/
+void polyveck_use_hint(polyveck *w, const polyveck *u, const polyveck *h) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        poly_use_hint(&w->vec[i], &u->vec[i], &h->vec[i]);
+    }
+}
+
+void polyveck_pack_w1(uint8_t r[K * POLYW1_PACKEDBYTES], const polyveck *w1) {
+    unsigned int i;
+
+    for (i = 0; i < K; ++i) {
+        polyw1_pack(&r[i * POLYW1_PACKEDBYTES], &w1->vec[i]);
+    }
+}

src/sign/dilithium/dilithium3/aarch64/polyvec.h

@@ -0,0 +1,96 @@
+#ifndef POLYVEC_H
+#define POLYVEC_H
+#include "params.h"
+#include "poly.h"
+#include <stdint.h>
+
+/* Vectors of polynomials of length L */
+typedef struct {
+    poly vec[L];
+} polyvecl;
+
+#define polyvecl_uniform_eta DILITHIUM_NAMESPACE(polyvecl_uniform_eta)
+void polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
+
+#define polyvecl_uniform_gamma1 DILITHIUM_NAMESPACE(polyvecl_uniform_gamma1)
+void polyvecl_uniform_gamma1(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
+
+#define polyvecl_reduce DILITHIUM_NAMESPACE(polyvecl_reduce)
+void polyvecl_reduce(polyvecl *v);
+
+#define polyvecl_freeze DILITHIUM_NAMESPACE(polyvecl_freeze)
+void polyvecl_freeze(polyvecl *v);
+
+#define polyvecl_add DILITHIUM_NAMESPACE(polyvecl_add)
+void polyvecl_add(polyvecl *w, const polyvecl *u, const polyvecl *v);
+
+#define polyvecl_ntt DILITHIUM_NAMESPACE(polyvecl_ntt)
+void polyvecl_ntt(polyvecl *v);
+#define polyvecl_invntt_tomont DILITHIUM_NAMESPACE(polyvecl_invntt_tomont)
+void polyvecl_invntt_tomont(polyvecl *v);
+#define polyvecl_pointwise_poly_montgomery DILITHIUM_NAMESPACE(polyvecl_pointwise_poly_montgomery)
+void polyvecl_pointwise_poly_montgomery(polyvecl *r, const poly *a, const polyvecl *v);
+#define polyvecl_pointwise_acc_montgomery DILITHIUM_NAMESPACE(polyvecl_pointwise_acc_montgomery)
+void polyvecl_pointwise_acc_montgomery(poly *w,
+                                       const polyvecl *u,
+                                       const polyvecl *v);
+
+
+#define polyvecl_chknorm DILITHIUM_NAMESPACE(polyvecl_chknorm)
+int polyvecl_chknorm(const polyvecl *v, int32_t B);
+
+
+
+/* Vectors of polynomials of length K */
+typedef struct {
+    poly vec[K];
+} polyveck;
+
+#define polyveck_uniform_eta DILITHIUM_NAMESPACE(polyveck_uniform_eta)
+void polyveck_uniform_eta(polyveck *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
+
+#define polyveck_reduce DILITHIUM_NAMESPACE(polyveck_reduce)
+void polyveck_reduce(polyveck *v);
+#define polyveck_caddq DILITHIUM_NAMESPACE(polyveck_caddq)
+void polyveck_caddq(polyveck *v);
+#define polyveck_freeze DILITHIUM_NAMESPACE(polyveck_freeze)
+void polyveck_freeze(polyveck *v);
+
+#define polyveck_add DILITHIUM_NAMESPACE(polyveck_add)
+void polyveck_add(polyveck *w, const polyveck *u, const polyveck *v);
+#define polyveck_sub DILITHIUM_NAMESPACE(polyveck_sub)
+void polyveck_sub(polyveck *w, const polyveck *u, const polyveck *v);
+#define polyveck_shiftl DILITHIUM_NAMESPACE(polyveck_shiftl)
+void polyveck_shiftl(polyveck *v);
+
+#define polyveck_ntt DILITHIUM_NAMESPACE(polyveck_ntt)
+void polyveck_ntt(polyveck *v);
+#define polyveck_invntt_tomont DILITHIUM_NAMESPACE(polyveck_invntt_tomont)
+void polyveck_invntt_tomont(polyveck *v);
+#define polyveck_pointwise_poly_montgomery DILITHIUM_NAMESPACE(polyveck_pointwise_poly_montgomery)
+void polyveck_pointwise_poly_montgomery(polyveck *r, const poly *a, const polyveck *v);
+
+#define polyveck_chknorm DILITHIUM_NAMESPACE(polyveck_chknorm)
+int polyveck_chknorm(const polyveck *v, int32_t B);
+
+#define polyveck_power2round DILITHIUM_NAMESPACE(polyveck_power2round)
+void polyveck_power2round(polyveck *v1, polyveck *v0, const polyveck *v);
+#define polyveck_decompose DILITHIUM_NAMESPACE(polyveck_decompose)
+void polyveck_decompose(polyveck *v1, polyveck *v0, const polyveck *v);
+#define polyveck_make_hint DILITHIUM_NAMESPACE(polyveck_make_hint)
+unsigned int polyveck_make_hint(polyveck *h,
+                                const polyveck *v0,
+                                const polyveck *v1);
+#define polyveck_use_hint DILITHIUM_NAMESPACE(polyveck_use_hint)
+void polyveck_use_hint(polyveck *w, const polyveck *u, const polyveck *h);
+
+#define polyveck_pack_w1 DILITHIUM_NAMESPACE(polyveck_pack_w1)
+void polyveck_pack_w1(uint8_t r[K * POLYW1_PACKEDBYTES], const polyveck *w1);
+
+#define polyvec_matrix_expand DILITHIUM_NAMESPACE(polyvec_matrix_expand)
+void polyvec_matrix_expand(polyvecl mat[K], const uint8_t rho[SEEDBYTES]);
+
+#define polyvec_matrix_pointwise_montgomery DILITHIUM_NAMESPACE(polyvec_matrix_pointwise_montgomery)
+void polyvec_matrix_pointwise_montgomery(polyveck *t, const polyvecl mat[K], const polyvecl *v);
+
+#endif

src/sign/dilithium/dilithium3/aarch64/reduce.c

@@ -0,0 +1,69 @@
+#include "params.h"
+#include "reduce.h"
+#include <stdint.h>
+
+/*************************************************
+* Name:        montgomery_reduce
+*
+* Description: For finite field element a with -2^{31}Q <= a <= Q*2^31,
+*              compute r \equiv a*2^{-32} (mod Q) such that -Q < r < Q.
+*
+* Arguments:   - int64_t: finite field element a
+*
+* Returns r.
+**************************************************/
+int32_t montgomery_reduce(int64_t a) {
+    int32_t t;
+
+    t = (int32_t)((uint64_t)a * (uint64_t)DILITHIUM_QINV);
+    t = (a - (int64_t)t * DILITHIUM_Q) >> 32;
+    return t;
+}
+
+/*************************************************
+* Name:        reduce32
+*
+* Description: For finite field element a with a <= 2^{31} - 2^{22} - 1,
+*              compute r \equiv a (mod Q) such that -6283009 <= r <= 6283007.
+*
+* Arguments:   - int32_t: finite field element a
+*
+* Returns r.
+**************************************************/
+int32_t reduce32(int32_t a) {
+    int32_t t;
+
+    t = (a + (1 << 22)) >> 23;
+    t = a - t * DILITHIUM_Q;
+    return t;
+}
+
+/*************************************************
+* Name:        caddq
+*
+* Description: Add Q if input coefficient is negative.
+*
+* Arguments:   - int32_t: finite field element a
+*
+* Returns r.
+**************************************************/
+int32_t caddq(int32_t a) {
+    a += (a >> 31) & DILITHIUM_Q;
+    return a;
+}
+
+/*************************************************
+* Name:        freeze
+*
+* Description: For finite field element a, compute standard
+*              representative r = a mod^+ Q.
+*
+* Arguments:   - int32_t: finite field element a
+*
+* Returns r.
+**************************************************/
+int32_t freeze(int32_t a) {
+    a = reduce32(a);
+    a = caddq(a);
+    return a;
+}

src/sign/dilithium/dilithium3/aarch64/reduce.h

@@ -0,0 +1,20 @@
+#ifndef REDUCE_H
+#define REDUCE_H
+#include "params.h"
+#include <stdint.h>
+
+#define DILITHIUM_QINV 58728449 // q^(-1) mod 2^32
+
+#define montgomery_reduce DILITHIUM_NAMESPACE(montgomery_reduce)
+int32_t montgomery_reduce(int64_t a);
+
+#define reduce32 DILITHIUM_NAMESPACE(reduce32)
+int32_t reduce32(int32_t a);
+
+#define caddq DILITHIUM_NAMESPACE(caddq)
+int32_t caddq(int32_t a);
+
+#define freeze DILITHIUM_NAMESPACE(freeze)
+int32_t freeze(int32_t a);
+
+#endif

src/sign/dilithium/dilithium3/aarch64/rounding.c

@@ -0,0 +1,96 @@
+#include "params.h"
+#include "rounding.h"
+#include <stdint.h>
+
+/*************************************************
+* Name:        power2round
+*
+* Description: For finite field element a, compute a0, a1 such that
+*              a mod^+ Q = a1*2^D + a0 with -2^{D-1} < a0 <= 2^{D-1}.
+*              Assumes a to be standard representative.
+*
+* Arguments:   - int32_t a: input element
+*              - int32_t *a0: pointer to output element a0
+*
+* Returns a1.
+**************************************************/
+int32_t power2round(int32_t *a0, int32_t a)  {
+    int32_t a1;
+
+    a1 = (a + (1 << (D - 1)) - 1) >> D;
+    *a0 = a - (a1 << D);
+    return a1;
+}
+
+/*************************************************
+* Name:        decompose
+*
+* Description: For finite field element a, compute high and low bits a0, a1 such
+*              that a mod^+ Q = a1*ALPHA + a0 with -ALPHA/2 < a0 <= ALPHA/2 except
+*              if a1 = (Q-1)/ALPHA where we set a1 = 0 and
+*              -ALPHA/2 <= a0 = a mod^+ Q - Q < 0. Assumes a to be standard
+*              representative.
+*
+* Arguments:   - int32_t a: input element
+*              - int32_t *a0: pointer to output element a0
+*
+* Returns a1.
+**************************************************/
+int32_t decompose(int32_t *a0, int32_t a) {
+    int32_t a1;
+
+    a1  = (a + 127) >> 7;
+
+    a1  = (a1 * 1025 + (1 << 21)) >> 22;
+    a1 &= 15;
+
+
+    *a0  = a - a1 * 2 * GAMMA2;
+    *a0 -= (((DILITHIUM_Q - 1) / 2 - *a0) >> 31) & DILITHIUM_Q;
+    return a1;
+}
+
+/*************************************************
+* Name:        make_hint
+*
+* Description: Compute hint bit indicating whether the low bits of the
+*              input element overflow into the high bits.
+*
+* Arguments:   - int32_t a0: low bits of input element
+*              - int32_t a1: high bits of input element
+*
+* Returns 1 if overflow.
+**************************************************/
+unsigned int make_hint(int32_t a0, int32_t a1) {
+    if (a0 > GAMMA2 || a0 < -GAMMA2 || (a0 == -GAMMA2 && a1 != 0)) {
+        return 1;
+    }
+
+    return 0;
+}
+
+/*************************************************
+* Name:        use_hint
+*
+* Description: Correct high bits according to hint.
+*
+* Arguments:   - int32_t a: input element
+*              - unsigned int hint: hint bit
+*
+* Returns corrected high bits.
+**************************************************/
+int32_t use_hint(int32_t a, unsigned int hint) {
+    int32_t a0, a1;
+
+    a1 = decompose(&a0, a);
+    if (hint == 0) {
+        return a1;
+    }
+
+
+    if (a0 > 0) {
+        return (a1 + 1) & 15;
+    }
+    return (a1 - 1) & 15;
+
+}

src/sign/dilithium/dilithium3/aarch64/rounding.h

@@ -0,0 +1,18 @@
+#ifndef ROUNDING_H
+#define ROUNDING_H
+#include "params.h"
+#include <stdint.h>
+
+#define power2round DILITHIUM_NAMESPACE(power2round)
+int32_t power2round(int32_t *a0, int32_t a);
+
+#define decompose DILITHIUM_NAMESPACE(decompose)
+int32_t decompose(int32_t *a0, int32_t a);
+
+#define make_hint DILITHIUM_NAMESPACE(make_hint)
+unsigned int make_hint(int32_t a0, int32_t a1);
+
+#define use_hint DILITHIUM_NAMESPACE(use_hint)
+int32_t use_hint(int32_t a, unsigned int hint);
+
+#endif

src/sign/dilithium/dilithium3/aarch64/sign.c

@@ -0,0 +1,343 @@
+#include "fips202.h"
+#include "packing.h"
+#include "params.h"
+#include "poly.h"
+#include "polyvec.h"
+#include "randombytes.h"
+#include "sign.h"
+#include "symmetric.h"
+#include <stdint.h>
+
+/*************************************************
+* Name:        crypto_sign_keypair
+*
+* Description: Generates public and private key.
+*
+* Arguments:   - uint8_t *pk: pointer to output public key (allocated
+*                             array of CRYPTO_PUBLICKEYBYTES bytes)
+*              - uint8_t *sk: pointer to output private key (allocated
+*                             array of CRYPTO_SECRETKEYBYTES bytes)
+*
+* Returns 0 (success)
+**************************************************/
+int crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
+    uint8_t seedbuf[2 * SEEDBYTES + CRHBYTES];
+    uint8_t tr[SEEDBYTES];
+    const uint8_t *rho, *rhoprime, *key;
+    polyvecl mat[K];
+    polyvecl s1, s1hat;
+    polyveck s2, t1, t0;
+
+    /* Get randomness for rho, rhoprime and key */
+    randombytes(seedbuf, SEEDBYTES);
+    shake256(seedbuf, 2 * SEEDBYTES + CRHBYTES, seedbuf, SEEDBYTES);
+    rho = seedbuf;
+    rhoprime = rho + SEEDBYTES;
+    key = rhoprime + CRHBYTES;
+
+    /* Expand matrix */
+    polyvec_matrix_expand(mat, rho);
+
+    /* Sample short vectors s1 and s2 */
+    polyvecl_uniform_eta(&s1, rhoprime, 0);
+    polyveck_uniform_eta(&s2, rhoprime, L);
+
+    /* Matrix-vector multiplication */
+    s1hat = s1;
+    polyvecl_ntt(&s1hat);
+    polyvec_matrix_pointwise_montgomery(&t1, mat, &s1hat);
+    polyveck_reduce(&t1);
+    polyveck_invntt_tomont(&t1);
+
+    /* Add error vector s2 */
+    polyveck_add(&t1, &t1, &s2);
+
+    /* Extract t1 and write public key */
+    polyveck_caddq(&t1);
+    polyveck_power2round(&t1, &t0, &t1);
+    pack_pk(pk, rho, &t1);
+
+    /* Compute H(rho, t1) and write secret key */
+    shake256(tr, SEEDBYTES, pk, CRYPTO_PUBLICKEYBYTES);
+    pack_sk(sk, rho, tr, key, &t0, &s1, &s2);
+
+    return 0;
+}
+
+/*************************************************
+* Name:        crypto_sign_signature
+*
+* Description: Computes signature.
+*
+* Arguments:   - uint8_t *sig:   pointer to output signature (of length CRYPTO_BYTES)
+*              - size_t *siglen: pointer to output length of signature
+*              - uint8_t *m:     pointer to message to be signed
+*              - size_t mlen:    length of message
+*              - uint8_t *sk:    pointer to bit-packed secret key
+*
+* Returns 0 (success)
+**************************************************/
+int crypto_sign_signature(uint8_t *sig,
+                          size_t *siglen,
+                          const uint8_t *m,
+                          size_t mlen,
+                          const uint8_t *sk) {
+    unsigned int n;
+    uint8_t seedbuf[3 * SEEDBYTES + 2 * CRHBYTES];
+    uint8_t *rho, *tr, *key, *mu, *rhoprime;
+    uint16_t nonce = 0;
+    polyvecl mat[K], s1, y, z;
+    polyveck t0, s2, w1, w0, h;
+    poly cp;
+    shake256incctx state;
+
+    rho = seedbuf;
+    tr = rho + SEEDBYTES;
+    key = tr + SEEDBYTES;
+    mu = key + SEEDBYTES;
+    rhoprime = mu + CRHBYTES;
+    unpack_sk(rho, tr, key, &t0, &s1, &s2, sk);
+
+    /* Compute CRH(tr, msg) */
+    shake256_inc_init(&state);
+    shake256_inc_absorb(&state, tr, SEEDBYTES);
+    shake256_inc_absorb(&state, m, mlen);
+    shake256_inc_finalize(&state);
+    shake256_inc_squeeze(mu, CRHBYTES, &state);
+    shake256_inc_ctx_release(&state);
+
+    shake256(rhoprime, CRHBYTES, key, SEEDBYTES + CRHBYTES);
+
+    /* Expand matrix and transform vectors */
+    polyvec_matrix_expand(mat, rho);
+    polyvecl_ntt(&s1);
+    polyveck_ntt(&s2);
+    polyveck_ntt(&t0);
+
+rej:
+    /* Sample intermediate vector y */
+    polyvecl_uniform_gamma1(&y, rhoprime, nonce++);
+
+    /* Matrix-vector multiplication */
+    z = y;
+    polyvecl_ntt(&z);
+    polyvec_matrix_pointwise_montgomery(&w1, mat, &z);
+    polyveck_reduce(&w1);
+    polyveck_invntt_tomont(&w1);
+
+    /* Decompose w and call the random oracle */
+    polyveck_caddq(&w1);
+    polyveck_decompose(&w1, &w0, &w1);
+    polyveck_pack_w1(sig, &w1);
+
+    shake256_inc_init(&state);
+    shake256_inc_absorb(&state, mu, CRHBYTES);
+    shake256_inc_absorb(&state, sig, K * POLYW1_PACKEDBYTES);
+    shake256_inc_finalize(&state);
+    shake256_inc_squeeze(sig, SEEDBYTES, &state);
+    shake256_inc_ctx_release(&state);
+    poly_challenge(&cp, sig);
+    poly_ntt(&cp);
+
+    /* Compute z, reject if it reveals secret */
+    polyvecl_pointwise_poly_montgomery(&z, &cp, &s1);
+    polyvecl_invntt_tomont(&z);
+    polyvecl_add(&z, &z, &y);
+    polyvecl_reduce(&z);
+    if (polyvecl_chknorm(&z, GAMMA1 - BETA)) {
+        goto rej;
+    }
+
+    /* Check that subtracting cs2 does not change high bits of w and low bits
+     * do not reveal secret information */
+    polyveck_pointwise_poly_montgomery(&h, &cp, &s2);
+    polyveck_invntt_tomont(&h);
+    polyveck_sub(&w0, &w0, &h);
+    polyveck_reduce(&w0);
+    if (polyveck_chknorm(&w0, GAMMA2 - BETA)) {
+        goto rej;
+    }
+
+    /* Compute hints for w1 */
+    polyveck_pointwise_poly_montgomery(&h, &cp, &t0);
+    polyveck_invntt_tomont(&h);
+    polyveck_reduce(&h);
+    if (polyveck_chknorm(&h, GAMMA2)) {
+        goto rej;
+    }
+
+    polyveck_add(&w0, &w0, &h);
+    n = polyveck_make_hint(&h, &w0, &w1);
+    if (n > OMEGA) {
+        goto rej;
+    }
+
+    /* Write signature */
+    pack_sig(sig, sig, &z, &h);
+    *siglen = CRYPTO_BYTES;
+    return 0;
+}
+
+/*************************************************
+* Name:        crypto_sign
+*
+* Description: Compute signed message.
+*
+* Arguments:   - uint8_t *sm: pointer to output signed message (allocated
+*                             array with CRYPTO_BYTES + mlen bytes),
+*                             can be equal to m
+*              - size_t *smlen: pointer to output length of signed
+*                               message
+*              - const uint8_t *m: pointer to message to be signed
+*              - size_t mlen: length of message
+*              - const uint8_t *sk: pointer to bit-packed secret key
+*
+* Returns 0 (success)
+**************************************************/
+int crypto_sign(uint8_t *sm,
+                size_t *smlen,
+                const uint8_t *m,
+                size_t mlen,
+                const uint8_t *sk) {
+    size_t i;
+
+    for (i = 0; i < mlen; ++i) {
+        sm[CRYPTO_BYTES + mlen - 1 - i] = m[mlen - 1 - i];
+    }
+    crypto_sign_signature(sm, smlen, sm + CRYPTO_BYTES, mlen, sk);
+    *smlen += mlen;
+    return 0;
+}
+
+/*************************************************
+* Name:        crypto_sign_verify
+*
+* Description: Verifies signature.
+*
+* Arguments:   - uint8_t *m: pointer to input signature
+*              - size_t siglen: length of signature
+*              - const uint8_t *m: pointer to message
+*              - size_t mlen: length of message
+*              - const uint8_t *pk: pointer to bit-packed public key
+*
+* Returns 0 if signature could be verified correctly and -1 otherwise
+**************************************************/
+int crypto_sign_verify(const uint8_t *sig,
+                       size_t siglen,
+                       const uint8_t *m,
+                       size_t mlen,
+                       const uint8_t *pk) {
+    unsigned int i;
+    uint8_t buf[K * POLYW1_PACKEDBYTES];
+    uint8_t rho[SEEDBYTES];
+    uint8_t mu[CRHBYTES];
+    uint8_t c[SEEDBYTES];
+    uint8_t c2[SEEDBYTES];
+    poly cp;
+    polyvecl mat[K], z;
+    polyveck t1, w1, h;
+    shake256incctx state;
+
+    if (siglen != CRYPTO_BYTES) {
+        return -1;
+    }
+
+    unpack_pk(rho, &t1, pk);
+    if (unpack_sig(c, &z, &h, sig)) {
+        return -1;
+    }
+    if (polyvecl_chknorm(&z, GAMMA1 - BETA)) {
+        return -1;
+    }
+
+    /* Compute CRH(H(rho, t1), msg) */
+    shake256(mu, SEEDBYTES, pk, CRYPTO_PUBLICKEYBYTES);
+    shake256_inc_init(&state);
+    shake256_inc_absorb(&state, mu, SEEDBYTES);
+    shake256_inc_absorb(&state, m, mlen);
+    shake256_inc_finalize(&state);
+    shake256_inc_squeeze(mu, CRHBYTES, &state);
+    shake256_inc_ctx_release(&state);
+
+    /* Matrix-vector multiplication; compute Az - c2^dt1 */
+    poly_challenge(&cp, c);
+    polyvec_matrix_expand(mat, rho);
+
+    polyvecl_ntt(&z);
+    polyvec_matrix_pointwise_montgomery(&w1, mat, &z);
+
+    poly_ntt(&cp);
+    polyveck_shiftl(&t1);
+    polyveck_ntt(&t1);
+    polyveck_pointwise_poly_montgomery(&t1, &cp, &t1);
+
+    polyveck_sub(&w1, &w1, &t1);
+    polyveck_reduce(&w1);
+    polyveck_invntt_tomont(&w1);
+
+    /* Reconstruct w1 */
+    polyveck_caddq(&w1);
+    polyveck_use_hint(&w1, &w1, &h);
+    polyveck_pack_w1(buf, &w1);
+
+    /* Call random oracle and verify challenge */
+    shake256_inc_init(&state);
+    shake256_inc_absorb(&state, mu, CRHBYTES);
+    shake256_inc_absorb(&state, buf, K * POLYW1_PACKEDBYTES);
+    shake256_inc_finalize(&state);
+    shake256_inc_squeeze(c2, SEEDBYTES, &state);
+    shake256_inc_ctx_release(&state);
+    for (i = 0; i < SEEDBYTES; ++i) {
+        if (c[i] != c2[i]) {
+            return -1;
+        }
+    }
+
+    return 0;
+}
+
+/*************************************************
+* Name:        crypto_sign_open
+*
+* Description: Verify signed message.
+*
+* Arguments:   - uint8_t *m: pointer to output message (allocated
+*                            array with smlen bytes), can be equal to sm
+*              - size_t *mlen: pointer to output length of message
+*              - const uint8_t *sm: pointer to signed message
+*              - size_t smlen: length of signed message
+*              - const uint8_t *pk: pointer to bit-packed public key
+*
+* Returns 0 if signed message could be verified correctly and -1 otherwise
+**************************************************/
+int crypto_sign_open(uint8_t *m,
+                     size_t *mlen,
+                     const uint8_t *sm,
+                     size_t smlen,
+                     const uint8_t *pk) {
+    size_t i;
+
+    if (smlen < CRYPTO_BYTES) {
+        goto badsig;
+    }
+
+    *mlen = smlen - CRYPTO_BYTES;
+    if (crypto_sign_verify(sm, CRYPTO_BYTES, sm + CRYPTO_BYTES, *mlen, pk)) {
+        goto badsig;
+    } else {
+        /* All good, copy msg, return 0 */
+        for (i = 0; i < *mlen; ++i) {
+            m[i] = sm[CRYPTO_BYTES + i];
+        }
+        return 0;
+    }
+
+badsig:
+    /* Signature verification failed */
+    *mlen = (size_t) -1;
+    for (i = 0; i < smlen; ++i) {
+        m[i] = 0;
+    }
+
+    return -1;
+}

src/sign/dilithium/dilithium3/aarch64/sign.h

@@ -0,0 +1,37 @@
+#ifndef SIGN_H
+#define SIGN_H
+#include "params.h"
+#include "poly.h"
+#include "polyvec.h"
+#include <stddef.h>
+#include <stdint.h>
+
+
+
+#define challenge DILITHIUM_NAMESPACE(challenge)
+void challenge(poly *c, const uint8_t seed[SEEDBYTES]);
+
+#define crypto_sign_keypair DILITHIUM_NAMESPACE(crypto_sign_keypair)
+int crypto_sign_keypair(uint8_t *pk, uint8_t *sk);
+
+#define crypto_sign_signature DILITHIUM_NAMESPACE(crypto_sign_signature)
+int crypto_sign_signature(uint8_t *sig, size_t *siglen,
+                          const uint8_t *m, size_t mlen,
+                          const uint8_t *sk);
+
+#define crypto_sign DILITHIUM_NAMESPACETOP
+int crypto_sign(uint8_t *sm, size_t *smlen,
+                const uint8_t *m, size_t mlen,
+                const uint8_t *sk);
+
+#define crypto_sign_verify DILITHIUM_NAMESPACE(crypto_sign_verify)
+int crypto_sign_verify(const uint8_t *sig, size_t siglen,
+                       const uint8_t *m, size_t mlen,
+                       const uint8_t *pk);
+
+#define crypto_sign_open DILITHIUM_NAMESPACE(crypto_sign_open)
+int crypto_sign_open(uint8_t *m, size_t *mlen,
+                     const uint8_t *sm, size_t smlen,
+                     const uint8_t *pk);
+
+#endif

src/sign/dilithium/dilithium3/aarch64/symmetric-shake.c

@@ -0,0 +1,66 @@
+#include "fips202.h"
+#include "params.h"
+#include "symmetric.h"
+#include <stdint.h>
+
+void dilithium_shake128_stream_init(shake128incctx *state, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
+    uint8_t t[2];
+    t[0] = (uint8_t) nonce;
+    t[1] = (uint8_t) (nonce >> 8);
+
+    shake128_inc_init(state);
+    shake128_inc_absorb(state, seed, SEEDBYTES);
+    shake128_inc_absorb(state, t, 2);
+    shake128_inc_finalize(state);
+}
+
+void dilithium_shake256_stream_init(shake256incctx *state, const uint8_t seed[CRHBYTES], uint16_t nonce) {
+    uint8_t t[2];
+    t[0] = (uint8_t) nonce;
+    t[1] = (uint8_t) (nonce >> 8);
+
+    shake256_inc_init(state);
+    shake256_inc_absorb(state, seed, CRHBYTES);
+    shake256_inc_absorb(state, t, 2);
+    shake256_inc_finalize(state);
+}
+
+void dilithium_shake128x2_stream_init(keccakx2_state *state,
+                                      const uint8_t seed[SEEDBYTES],
+                                      uint16_t nonce1, uint16_t nonce2) {
+    unsigned int i;
+    uint8_t extseed1[SEEDBYTES + 2 + 14];
+    uint8_t extseed2[SEEDBYTES + 2 + 14];
+
+    for (i = 0; i < SEEDBYTES; i++) {
+        extseed1[i] = seed[i];
+        extseed2[i] = seed[i];
+    }
+    extseed1[SEEDBYTES] = (uint8_t) nonce1;
+    extseed1[SEEDBYTES + 1] = (uint8_t) (nonce1 >> 8);
+
+    extseed2[SEEDBYTES  ] = (uint8_t) nonce2;
+    extseed2[SEEDBYTES + 1] = (uint8_t) (nonce2 >> 8);
+
+    shake128x2_absorb(state, extseed1, extseed2, SEEDBYTES + 2);
+}
+
+void dilithium_shake256x2_stream_init(keccakx2_state *state,
+                                      const uint8_t seed[CRHBYTES],
+                                      uint16_t nonce1, uint16_t nonce2) {
+    unsigned int i;
+    uint8_t extseed1[CRHBYTES + 2 + 14];
+    uint8_t extseed2[CRHBYTES + 2 + 14];
+
+    for (i = 0; i < CRHBYTES; i++) {
+        extseed1[i] = seed[i];
+        extseed2[i] = seed[i];
+    }
+    extseed1[CRHBYTES] = (uint8_t) nonce1;
+    extseed1[CRHBYTES + 1] = (uint8_t) (nonce1 >> 8);
+
+    extseed2[CRHBYTES  ] = (uint8_t) nonce2;
+    extseed2[CRHBYTES + 1] = (uint8_t) (nonce2 >> 8);
+
+    shake256x2_absorb(state, extseed1, extseed2, CRHBYTES + 2);
+}

src/sign/dilithium/dilithium3/aarch64/symmetric.h

@@ -0,0 +1,47 @@
+#ifndef SYMMETRIC_H
+#define SYMMETRIC_H
+#include "fips202.h"
+#include "fips202x2.h"
+#include "params.h"
+#include <stdint.h>
+
+
+typedef shake128incctx stream128_state;
+typedef shake256incctx stream256_state;
+
+#define dilithium_shake128_stream_init DILITHIUM_NAMESPACE(dilithium_shake128_stream_init)
+void dilithium_shake128_stream_init(shake128incctx *state,
+                                    const uint8_t seed[SEEDBYTES],
+                                    uint16_t nonce);
+
+#define dilithium_shake256_stream_init DILITHIUM_NAMESPACE(dilithium_shake256_stream_init)
+void dilithium_shake256_stream_init(shake256incctx *state,
+                                    const uint8_t seed[CRHBYTES],
+                                    uint16_t nonce);
+
+#define dilithium_shake128x2_stream_init DILITHIUM_NAMESPACE(dilithium_shake128x2_stream_init)
+void dilithium_shake128x2_stream_init(keccakx2_state *state,
+                                      const uint8_t seed[SEEDBYTES],
+                                      uint16_t nonce1, uint16_t nonce2);
+#define dilithium_shake256x2_stream_init DILITHIUM_NAMESPACE(dilithium_shake256x2_stream_init)
+void dilithium_shake256x2_stream_init(keccakx2_state *state,
+                                      const uint8_t seed[CRHBYTES],
+                                      uint16_t nonce1, uint16_t nonce2);
+
+
+#define STREAM128_BLOCKBYTES SHAKE128_RATE
+#define STREAM256_BLOCKBYTES SHAKE256_RATE
+
+#define stream128_init(STATE, SEED, NONCE) \
+    dilithium_shake128_stream_init(STATE, SEED, NONCE)
+#define stream128_squeezeblocks(OUT, OUTBLOCKS, STATE) \
+    shake128_inc_squeeze(OUT, (OUTBLOCKS)*(SHAKE128_RATE), STATE)
+#define stream128_release(STATE) shake128_inc_ctx_release(STATE)
+#define stream256_init(STATE, SEED, NONCE) \
+    dilithium_shake256_stream_init(STATE, SEED, NONCE)
+#define stream256_squeezeblocks(OUT, OUTBLOCKS, STATE) \
+    shake256_inc_squeeze(OUT, (OUTBLOCKS)*(SHAKE256_RATE), STATE)
+#define stream256_release(STATE) shake256_inc_ctx_release(STATE)
+
+
+#endif

src/sign/dilithium/dilithium3/avx2/api.h

@@ -5,12 +5,11 @@
 #include <stdint.h>
 
 #define PQCLEAN_DILITHIUM3_AVX2_CRYPTO_PUBLICKEYBYTES 1952
-#define PQCLEAN_DILITHIUM3_AVX2_CRYPTO_SECRETKEYBYTES 4016
+#define PQCLEAN_DILITHIUM3_AVX2_CRYPTO_SECRETKEYBYTES 4000
 #define PQCLEAN_DILITHIUM3_AVX2_CRYPTO_BYTES 3293
 
 #define PQCLEAN_DILITHIUM3_AVX2_CRYPTO_ALGNAME "Dilithium3"
 
-
 int PQCLEAN_DILITHIUM3_AVX2_crypto_sign_keypair(uint8_t *pk, uint8_t *sk);
 
 int PQCLEAN_DILITHIUM3_AVX2_crypto_sign_signature(

src/sign/dilithium/dilithium3/avx2/fips202x4.c

@@ -91,17 +91,22 @@ static void keccakx4_squeezeblocks(uint8_t *out0,
                                    unsigned int r,
                                    __m256i s[25]) {
     unsigned int i;
+    double temp0, temp1;
     __m128d t;
 
     while (nblocks > 0) {
         PQCLEAN_DILITHIUM3_AVX2_f1600x4(s, KeccakF_RoundConstants);
         for (i = 0; i < r / 8; ++i) {
             t = _mm_castsi128_pd(_mm256_castsi256_si128(s[i]));
-            _mm_storel_pd((double *)&out0[8 * i], t);
-            _mm_storeh_pd((double *)&out1[8 * i], t);
+            _mm_storel_pd(&temp0, t);
+            _mm_storeh_pd(&temp1, t);
+            memcpy(&out0[8 * i], &temp0, sizeof(double));
+            memcpy(&out1[8 * i], &temp1, sizeof(double));
             t = _mm_castsi128_pd(_mm256_extracti128_si256(s[i], 1));
-            _mm_storel_pd((double *)&out2[8 * i], t);
-            _mm_storeh_pd((double *)&out3[8 * i], t);
+            _mm_storel_pd(&temp0, t);
+            _mm_storeh_pd(&temp1, t);
+            memcpy(&out2[8 * i], &temp0, sizeof(double));
+            memcpy(&out3[8 * i], &temp1, sizeof(double));
         }
 
         out0 += r;

src/sign/dilithium/dilithium3/avx2/packing.c

@@ -67,7 +67,7 @@ void PQCLEAN_DILITHIUM3_AVX2_unpack_pk(uint8_t rho[SEEDBYTES],
 **************************************************/
 void PQCLEAN_DILITHIUM3_AVX2_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM3_AVX2_CRYPTO_SECRETKEYBYTES],
                                      const uint8_t rho[SEEDBYTES],
-                                     const uint8_t tr[CRHBYTES],
+                                     const uint8_t tr[SEEDBYTES],
                                      const uint8_t key[SEEDBYTES],
                                      const polyveck *t0,
                                      const polyvecl *s1,
@@ -84,10 +84,10 @@ void PQCLEAN_DILITHIUM3_AVX2_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM3_AVX2_CRYPTO_S
     }
     sk += SEEDBYTES;
 
-    for (i = 0; i < CRHBYTES; ++i) {
+    for (i = 0; i < SEEDBYTES; ++i) {
         sk[i] = tr[i];
     }
-    sk += CRHBYTES;
+    sk += SEEDBYTES;
 
     for (i = 0; i < L; ++i) {
         PQCLEAN_DILITHIUM3_AVX2_polyeta_pack(sk + i * POLYETA_PACKEDBYTES, &s1->vec[i]);
@@ -118,7 +118,7 @@ void PQCLEAN_DILITHIUM3_AVX2_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM3_AVX2_CRYPTO_S
 *              - uint8_t sk[]: byte array containing bit-packed sk
 **************************************************/
 void PQCLEAN_DILITHIUM3_AVX2_unpack_sk(uint8_t rho[SEEDBYTES],
-                                       uint8_t tr[CRHBYTES],
+                                       uint8_t tr[SEEDBYTES],
                                        uint8_t key[SEEDBYTES],
                                        polyveck *t0,
                                        polyvecl *s1,
@@ -136,10 +136,10 @@ void PQCLEAN_DILITHIUM3_AVX2_unpack_sk(uint8_t rho[SEEDBYTES],
     }
     sk += SEEDBYTES;
 
-    for (i = 0; i < CRHBYTES; ++i) {
+    for (i = 0; i < SEEDBYTES; ++i) {
         tr[i] = sk[i];
     }
-    sk += CRHBYTES;
+    sk += SEEDBYTES;
 
     for (i = 0; i < L; ++i) {
         PQCLEAN_DILITHIUM3_AVX2_polyeta_unpack(&s1->vec[i], sk + i * POLYETA_PACKEDBYTES);

src/sign/dilithium/dilithium3/avx2/packing.h

@@ -8,7 +8,7 @@ void PQCLEAN_DILITHIUM3_AVX2_pack_pk(uint8_t pk[PQCLEAN_DILITHIUM3_AVX2_CRYPTO_P
 
 void PQCLEAN_DILITHIUM3_AVX2_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM3_AVX2_CRYPTO_SECRETKEYBYTES],
                                      const uint8_t rho[SEEDBYTES],
-                                     const uint8_t tr[CRHBYTES],
+                                     const uint8_t tr[SEEDBYTES],
                                      const uint8_t key[SEEDBYTES],
                                      const polyveck *t0,
                                      const polyvecl *s1,
@@ -19,7 +19,7 @@ void PQCLEAN_DILITHIUM3_AVX2_pack_sig(uint8_t sig[PQCLEAN_DILITHIUM3_AVX2_CRYPTO
 void PQCLEAN_DILITHIUM3_AVX2_unpack_pk(uint8_t rho[SEEDBYTES], polyveck *t1, const uint8_t pk[PQCLEAN_DILITHIUM3_AVX2_CRYPTO_PUBLICKEYBYTES]);
 
 void PQCLEAN_DILITHIUM3_AVX2_unpack_sk(uint8_t rho[SEEDBYTES],
-                                       uint8_t tr[CRHBYTES],
+                                       uint8_t tr[SEEDBYTES],
                                        uint8_t key[SEEDBYTES],
                                        polyveck *t0,
                                        polyvecl *s1,

src/sign/dilithium/dilithium3/avx2/params.h

@@ -4,7 +4,7 @@
 
 
 #define SEEDBYTES 32
-#define CRHBYTES 48
+#define CRHBYTES 64
 #define N 256
 #define Q 8380417
 #define D 13
@@ -32,7 +32,7 @@
 #define POLYETA_PACKEDBYTES 128
 
 #define PQCLEAN_DILITHIUM3_AVX2_CRYPTO_PUBLICKEYBYTES (SEEDBYTES + K*POLYT1_PACKEDBYTES)
-#define PQCLEAN_DILITHIUM3_AVX2_CRYPTO_SECRETKEYBYTES (2*SEEDBYTES + CRHBYTES \
+#define PQCLEAN_DILITHIUM3_AVX2_CRYPTO_SECRETKEYBYTES (3*SEEDBYTES \
         + L*POLYETA_PACKEDBYTES \
         + K*POLYETA_PACKEDBYTES \
         + K*POLYT0_PACKEDBYTES)

src/sign/dilithium/dilithium3/avx2/poly.c

@@ -72,25 +72,6 @@ void PQCLEAN_DILITHIUM3_AVX2_poly_caddq(poly *a) {
     DBENCH_STOP(*tred);
 }
 
-/*************************************************
-* Name:        PQCLEAN_DILITHIUM3_AVX2_poly_freeze
-*
-* Description: Inplace reduction of all coefficients of polynomial to
-*              positive standard representatives. Assumes input
-*              coefficients to be at most 2^31 - 2^22 + 1 in
-*              absolute value.
-*
-* Arguments:   - poly *a: pointer to input/output polynomial
-**************************************************/
-void PQCLEAN_DILITHIUM3_AVX2_poly_freeze(poly *a) {
-    DBENCH_START();
-
-    PQCLEAN_DILITHIUM3_AVX2_poly_reduce(a);
-    PQCLEAN_DILITHIUM3_AVX2_poly_caddq(a);
-
-    DBENCH_STOP(*tred);
-}
-
 /*************************************************
 * Name:        PQCLEAN_DILITHIUM3_AVX2_poly_add
 *
@@ -505,34 +486,34 @@ static unsigned int rej_eta(int32_t *a,
 *              or AES256CTR(seed,nonce).
 *
 * Arguments:   - poly *a: pointer to output polynomial
-*              - const uint8_t seed[]: byte array with seed of length  SEEDBYTES
+*              - const uint8_t seed[]: byte array with seed of length CRHBYTES
 *              - uint16_t nonce: 2-byte nonce
 **************************************************/
-void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_eta_preinit(poly *a, stream128_state *state) {
+void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_eta_preinit(poly *a, stream256_state *state) {
     unsigned int ctr;
-    ALIGNED_UINT8(REJ_UNIFORM_BUFLEN * STREAM128_BLOCKBYTES) buf;
+    ALIGNED_UINT8(REJ_UNIFORM_ETA_BUFLEN) buf;
 
-    stream128_squeezeblocks(buf.coeffs, REJ_UNIFORM_ETA_NBLOCKS, state);
+    stream256_squeezeblocks(buf.coeffs, REJ_UNIFORM_ETA_NBLOCKS, state);
     ctr = PQCLEAN_DILITHIUM3_AVX2_rej_eta_avx(a->coeffs, buf.coeffs);
 
     while (ctr < N) {
-        stream128_squeezeblocks(buf.coeffs, 1, state);
-        ctr += rej_eta(a->coeffs + ctr, N - ctr, buf.coeffs, STREAM128_BLOCKBYTES);
+        stream256_squeezeblocks(buf.coeffs, 1, state);
+        ctr += rej_eta(a->coeffs + ctr, N - ctr, buf.coeffs, STREAM256_BLOCKBYTES);
     }
 }
 
-void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_eta(poly *a, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
-    stream128_state state;
-    stream128_init(&state, seed, nonce);
+void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_eta(poly *a, const uint8_t seed[CRHBYTES], uint16_t nonce) {
+    stream256_state state;
+    stream256_init(&state, seed, nonce);
     PQCLEAN_DILITHIUM3_AVX2_poly_uniform_eta_preinit(a, &state);
-    stream128_release(&state);
+    stream256_release(&state);
 }
 
 void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_eta_4x(poly *a0,
         poly *a1,
         poly *a2,
         poly *a3,
-        const uint8_t seed[32],
+        const uint8_t seed[64],
         uint16_t nonce0,
         uint16_t nonce1,
         uint16_t nonce2,
@@ -543,23 +524,28 @@ void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_eta_4x(poly *a0,
     __m256i f;
     keccakx4_state state;
 
-    f = _mm256_loadu_si256((__m256i *)seed);
-    _mm256_store_si256(buf[0].vec, f);
-    _mm256_store_si256(buf[1].vec, f);
-    _mm256_store_si256(buf[2].vec, f);
-    _mm256_store_si256(buf[3].vec, f);
-
-    buf[0].coeffs[SEEDBYTES + 0] = nonce0;
-    buf[0].coeffs[SEEDBYTES + 1] = nonce0 >> 8;
-    buf[1].coeffs[SEEDBYTES + 0] = nonce1;
-    buf[1].coeffs[SEEDBYTES + 1] = nonce1 >> 8;
-    buf[2].coeffs[SEEDBYTES + 0] = nonce2;
-    buf[2].coeffs[SEEDBYTES + 1] = nonce2 >> 8;
-    buf[3].coeffs[SEEDBYTES + 0] = nonce3;
-    buf[3].coeffs[SEEDBYTES + 1] = nonce3 >> 8;
-
-    PQCLEAN_DILITHIUM3_AVX2_shake128x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, SEEDBYTES + 2);
-    PQCLEAN_DILITHIUM3_AVX2_shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, REJ_UNIFORM_ETA_NBLOCKS, &state);
+    f = _mm256_loadu_si256((__m256i *)&seed[0]);
+    _mm256_store_si256(&buf[0].vec[0], f);
+    _mm256_store_si256(&buf[1].vec[0], f);
+    _mm256_store_si256(&buf[2].vec[0], f);
+    _mm256_store_si256(&buf[3].vec[0], f);
+    f = _mm256_loadu_si256((__m256i *)&seed[32]);
+    _mm256_store_si256(&buf[0].vec[1], f);
+    _mm256_store_si256(&buf[1].vec[1], f);
+    _mm256_store_si256(&buf[2].vec[1], f);
+    _mm256_store_si256(&buf[3].vec[1], f);
+
+    buf[0].coeffs[64] = nonce0;
+    buf[0].coeffs[65] = nonce0 >> 8;
+    buf[1].coeffs[64] = nonce1;
+    buf[1].coeffs[65] = nonce1 >> 8;
+    buf[2].coeffs[64] = nonce2;
+    buf[2].coeffs[65] = nonce2 >> 8;
+    buf[3].coeffs[64] = nonce3;
+    buf[3].coeffs[65] = nonce3 >> 8;
+
+    PQCLEAN_DILITHIUM3_AVX2_shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 66);
+    PQCLEAN_DILITHIUM3_AVX2_shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, REJ_UNIFORM_ETA_NBLOCKS, &state);
 
     ctr0 = PQCLEAN_DILITHIUM3_AVX2_rej_eta_avx(a0->coeffs, buf[0].coeffs);
     ctr1 = PQCLEAN_DILITHIUM3_AVX2_rej_eta_avx(a1->coeffs, buf[1].coeffs);
@@ -567,12 +553,12 @@ void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_eta_4x(poly *a0,
     ctr3 = PQCLEAN_DILITHIUM3_AVX2_rej_eta_avx(a3->coeffs, buf[3].coeffs);
 
     while (ctr0 < N || ctr1 < N || ctr2 < N || ctr3 < N) {
-        PQCLEAN_DILITHIUM3_AVX2_shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 1, &state);
+        PQCLEAN_DILITHIUM3_AVX2_shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 1, &state);
 
-        ctr0 += rej_eta(a0->coeffs + ctr0, N - ctr0, buf[0].coeffs, SHAKE128_RATE);
-        ctr1 += rej_eta(a1->coeffs + ctr1, N - ctr1, buf[1].coeffs, SHAKE128_RATE);
-        ctr2 += rej_eta(a2->coeffs + ctr2, N - ctr2, buf[2].coeffs, SHAKE128_RATE);
-        ctr3 += rej_eta(a3->coeffs + ctr3, N - ctr3, buf[3].coeffs, SHAKE128_RATE);
+        ctr0 += rej_eta(a0->coeffs + ctr0, N - ctr0, buf[0].coeffs, SHAKE256_RATE);
+        ctr1 += rej_eta(a1->coeffs + ctr1, N - ctr1, buf[1].coeffs, SHAKE256_RATE);
+        ctr2 += rej_eta(a2->coeffs + ctr2, N - ctr2, buf[2].coeffs, SHAKE256_RATE);
+        ctr3 += rej_eta(a3->coeffs + ctr3, N - ctr3, buf[3].coeffs, SHAKE256_RATE);
     }
 }
 
@@ -606,7 +592,7 @@ void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_gamma1_4x(poly *a0,
         poly *a1,
         poly *a2,
         poly *a3,
-        const uint8_t seed[48],
+        const uint8_t seed[64],
         uint16_t nonce0,
         uint16_t nonce1,
         uint16_t nonce2,
@@ -614,29 +600,28 @@ void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_gamma1_4x(poly *a0,
     ALIGNED_UINT8(POLY_UNIFORM_GAMMA1_NBLOCKS * STREAM256_BLOCKBYTES + 14) buf[4];
     keccakx4_state state;
     __m256i f;
-    __m128i g;
 
-    f = _mm256_loadu_si256((__m256i *)seed);
-    _mm256_store_si256(buf[0].vec, f);
-    _mm256_store_si256(buf[1].vec, f);
-    _mm256_store_si256(buf[2].vec, f);
-    _mm256_store_si256(buf[3].vec, f);
-    g = _mm_loadu_si128((__m128i *)&seed[32]);
-    _mm_store_si128((__m128i *)&buf[0].vec[1], g);
-    _mm_store_si128((__m128i *)&buf[1].vec[1], g);
-    _mm_store_si128((__m128i *)&buf[2].vec[1], g);
-    _mm_store_si128((__m128i *)&buf[3].vec[1], g);
-
-    buf[0].coeffs[CRHBYTES + 0] = nonce0;
-    buf[0].coeffs[CRHBYTES + 1] = nonce0 >> 8;
-    buf[1].coeffs[CRHBYTES + 0] = nonce1;
-    buf[1].coeffs[CRHBYTES + 1] = nonce1 >> 8;
-    buf[2].coeffs[CRHBYTES + 0] = nonce2;
-    buf[2].coeffs[CRHBYTES + 1] = nonce2 >> 8;
-    buf[3].coeffs[CRHBYTES + 0] = nonce3;
-    buf[3].coeffs[CRHBYTES + 1] = nonce3 >> 8;
-
-    PQCLEAN_DILITHIUM3_AVX2_shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, CRHBYTES + 2);
+    f = _mm256_loadu_si256((__m256i *)&seed[0]);
+    _mm256_store_si256(&buf[0].vec[0], f);
+    _mm256_store_si256(&buf[1].vec[0], f);
+    _mm256_store_si256(&buf[2].vec[0], f);
+    _mm256_store_si256(&buf[3].vec[0], f);
+    f = _mm256_loadu_si256((__m256i *)&seed[32]);
+    _mm256_store_si256(&buf[0].vec[1], f);
+    _mm256_store_si256(&buf[1].vec[1], f);
+    _mm256_store_si256(&buf[2].vec[1], f);
+    _mm256_store_si256(&buf[3].vec[1], f);
+
+    buf[0].coeffs[64] = nonce0;
+    buf[0].coeffs[65] = nonce0 >> 8;
+    buf[1].coeffs[64] = nonce1;
+    buf[1].coeffs[65] = nonce1 >> 8;
+    buf[2].coeffs[64] = nonce2;
+    buf[2].coeffs[65] = nonce2 >> 8;
+    buf[3].coeffs[64] = nonce3;
+    buf[3].coeffs[65] = nonce3 >> 8;
+
+    PQCLEAN_DILITHIUM3_AVX2_shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 66);
     PQCLEAN_DILITHIUM3_AVX2_shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, POLY_UNIFORM_GAMMA1_NBLOCKS, &state);
 
     PQCLEAN_DILITHIUM3_AVX2_polyz_unpack(a0, buf[0].coeffs);
@@ -930,7 +915,7 @@ void PQCLEAN_DILITHIUM3_AVX2_polyz_pack(uint8_t r[POLYZ_PACKEDBYTES], const poly
 * Arguments:   - poly *r: pointer to output polynomial
 *              - const uint8_t *a: byte array with bit-packed polynomial
 **************************************************/
-void PQCLEAN_DILITHIUM3_AVX2_polyz_unpack(poly *restrict r, const uint8_t a[POLYZ_PACKEDBYTES + 12]) {
+void PQCLEAN_DILITHIUM3_AVX2_polyz_unpack(poly *restrict r, const uint8_t *a) {
     unsigned int i;
     __m256i f;
     const __m256i shufbidx = _mm256_set_epi8(-1, 11, 10, 9, -1, 9, 8, 7, -1, 6, 5, 4, -1, 4, 3, 2,
@@ -963,7 +948,7 @@ void PQCLEAN_DILITHIUM3_AVX2_polyz_unpack(poly *restrict r, const uint8_t a[POLY
 *                            POLYW1_PACKEDBYTES bytes
 *              - const poly *a: pointer to input polynomial
 **************************************************/
-void PQCLEAN_DILITHIUM3_AVX2_polyw1_pack(uint8_t r[POLYW1_PACKEDBYTES], const poly *restrict a) {
+void PQCLEAN_DILITHIUM3_AVX2_polyw1_pack(uint8_t *r, const poly *restrict a) {
     unsigned int i;
     __m256i f0, f1, f2, f3, f4, f5, f6, f7;
     const __m256i shift = _mm256_set1_epi16((16 << 8) + 1);

src/sign/dilithium/dilithium3/avx2/poly.h

@@ -9,7 +9,6 @@ typedef ALIGNED_INT32(N) poly;
 
 void PQCLEAN_DILITHIUM3_AVX2_poly_reduce(poly *a);
 void PQCLEAN_DILITHIUM3_AVX2_poly_caddq(poly *a);
-void PQCLEAN_DILITHIUM3_AVX2_poly_freeze(poly *a);
 
 void PQCLEAN_DILITHIUM3_AVX2_poly_add(poly *c, const poly *a, const poly *b);
 void PQCLEAN_DILITHIUM3_AVX2_poly_sub(poly *c, const poly *a, const poly *b);
@@ -28,8 +27,8 @@ void PQCLEAN_DILITHIUM3_AVX2_poly_use_hint(poly *b, const poly *a, const poly *h
 int PQCLEAN_DILITHIUM3_AVX2_poly_chknorm(const poly *a, int32_t B);
 void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_preinit(poly *a, stream128_state *state);
 void PQCLEAN_DILITHIUM3_AVX2_poly_uniform(poly *a, const uint8_t seed[SEEDBYTES], uint16_t nonce);
-void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_eta_preinit(poly *a, stream128_state *state);
-void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_eta(poly *a, const uint8_t seed[SEEDBYTES], uint16_t nonce);
+void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_eta_preinit(poly *a, stream256_state *state);
+void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_eta(poly *a, const uint8_t seed[CRHBYTES], uint16_t nonce);
 void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_gamma1_preinit(poly *a, stream256_state *state);
 void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_gamma1(poly *a, const uint8_t seed[CRHBYTES], uint16_t nonce);
 void PQCLEAN_DILITHIUM3_AVX2_poly_challenge(poly *c, const uint8_t seed[SEEDBYTES]);
@@ -47,7 +46,7 @@ void PQCLEAN_DILITHIUM3_AVX2_poly_uniform_eta_4x(poly *a0,
         poly *a1,
         poly *a2,
         poly *a3,
-        const uint8_t seed[SEEDBYTES],
+        const uint8_t seed[CRHBYTES],
         uint16_t nonce0,
         uint16_t nonce1,
         uint16_t nonce2,
@@ -72,8 +71,8 @@ void PQCLEAN_DILITHIUM3_AVX2_polyt0_pack(uint8_t r[POLYT0_PACKEDBYTES], const po
 void PQCLEAN_DILITHIUM3_AVX2_polyt0_unpack(poly *r, const uint8_t a[POLYT0_PACKEDBYTES]);
 
 void PQCLEAN_DILITHIUM3_AVX2_polyz_pack(uint8_t r[POLYZ_PACKEDBYTES], const poly *a);
-void PQCLEAN_DILITHIUM3_AVX2_polyz_unpack(poly *r, const uint8_t a[POLYZ_PACKEDBYTES + 14]);
+void PQCLEAN_DILITHIUM3_AVX2_polyz_unpack(poly *r, const uint8_t *a);
 
-void PQCLEAN_DILITHIUM3_AVX2_polyw1_pack(uint8_t r[POLYW1_PACKEDBYTES + 8], const poly *a);
+void PQCLEAN_DILITHIUM3_AVX2_polyw1_pack(uint8_t *r, const poly *a);
 
 #endif

src/sign/dilithium/dilithium3/avx2/polyvec.c

@@ -98,7 +98,7 @@ void PQCLEAN_DILITHIUM3_AVX2_polyvec_matrix_pointwise_montgomery(polyveck *t, co
 /************ Vectors of polynomials of length L **************/
 /**************************************************************/
 
-void PQCLEAN_DILITHIUM3_AVX2_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
+void PQCLEAN_DILITHIUM3_AVX2_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
     unsigned int i;
 
     for (i = 0; i < L; ++i) {
@@ -106,7 +106,7 @@ void PQCLEAN_DILITHIUM3_AVX2_polyvecl_uniform_eta(polyvecl *v, const uint8_t see
     }
 }
 
-void PQCLEAN_DILITHIUM3_AVX2_polyvecl_uniform_gamma1(polyvecl *v, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
+void PQCLEAN_DILITHIUM3_AVX2_polyvecl_uniform_gamma1(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
     unsigned int i;
 
     for (i = 0; i < L; ++i) {
@@ -122,22 +122,6 @@ void PQCLEAN_DILITHIUM3_AVX2_polyvecl_reduce(polyvecl *v) {
     }
 }
 
-/*************************************************
-* Name:        PQCLEAN_DILITHIUM3_AVX2_polyvecl_freeze
-*
-* Description: Reduce coefficients of polynomials in vector of length L
-*              to standard representatives.
-*
-* Arguments:   - polyvecl *v: pointer to input/output vector
-**************************************************/
-void PQCLEAN_DILITHIUM3_AVX2_polyvecl_freeze(polyvecl *v) {
-    unsigned int i;
-
-    for (i = 0; i < L; ++i) {
-        PQCLEAN_DILITHIUM3_AVX2_poly_freeze(&v->vec[i]);
-    }
-}
-
 /*************************************************
 * Name:        PQCLEAN_DILITHIUM3_AVX2_polyvecl_add
 *
@@ -231,7 +215,7 @@ int PQCLEAN_DILITHIUM3_AVX2_polyvecl_chknorm(const polyvecl *v, int32_t bound)
 /************ Vectors of polynomials of length K **************/
 /**************************************************************/
 
-void PQCLEAN_DILITHIUM3_AVX2_polyveck_uniform_eta(polyveck *v, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
+void PQCLEAN_DILITHIUM3_AVX2_polyveck_uniform_eta(polyveck *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
     unsigned int i;
 
     for (i = 0; i < K; ++i) {
@@ -271,22 +255,6 @@ void PQCLEAN_DILITHIUM3_AVX2_polyveck_caddq(polyveck *v) {
     }
 }
 
-/*************************************************
-* Name:        PQCLEAN_DILITHIUM3_AVX2_polyveck_freeze
-*
-* Description: Reduce coefficients of polynomials in vector of length K
-*              to standard representatives.
-*
-* Arguments:   - polyveck *v: pointer to input/output vector
-**************************************************/
-void PQCLEAN_DILITHIUM3_AVX2_polyveck_freeze(polyveck *v)  {
-    unsigned int i;
-
-    for (i = 0; i < K; ++i) {
-        PQCLEAN_DILITHIUM3_AVX2_poly_freeze(&v->vec[i]);
-    }
-}
-
 /*************************************************
 * Name:        PQCLEAN_DILITHIUM3_AVX2_polyveck_add
 *

src/sign/dilithium/dilithium3/avx2/polyvec.h

@@ -9,14 +9,12 @@ typedef struct {
     poly vec[L];
 } polyvecl;
 
-void PQCLEAN_DILITHIUM3_AVX2_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[SEEDBYTES], uint16_t nonce);
+void PQCLEAN_DILITHIUM3_AVX2_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
 
-void PQCLEAN_DILITHIUM3_AVX2_polyvecl_uniform_gamma1(polyvecl *v, const uint8_t seed[SEEDBYTES], uint16_t nonce);
+void PQCLEAN_DILITHIUM3_AVX2_polyvecl_uniform_gamma1(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
 
 void PQCLEAN_DILITHIUM3_AVX2_polyvecl_reduce(polyvecl *v);
 
-void PQCLEAN_DILITHIUM3_AVX2_polyvecl_freeze(polyvecl *v);
-
 void PQCLEAN_DILITHIUM3_AVX2_polyvecl_add(polyvecl *w, const polyvecl *u, const polyvecl *v);
 
 void PQCLEAN_DILITHIUM3_AVX2_polyvecl_ntt(polyvecl *v);
@@ -33,11 +31,10 @@ typedef struct {
     poly vec[K];
 } polyveck;
 
-void PQCLEAN_DILITHIUM3_AVX2_polyveck_uniform_eta(polyveck *v, const uint8_t seed[SEEDBYTES], uint16_t nonce);
+void PQCLEAN_DILITHIUM3_AVX2_polyveck_uniform_eta(polyveck *v, const uint8_t seed[CRHBYTES], uint16_t nonce);
 
 void PQCLEAN_DILITHIUM3_AVX2_polyveck_reduce(polyveck *v);
 void PQCLEAN_DILITHIUM3_AVX2_polyveck_caddq(polyveck *v);
-void PQCLEAN_DILITHIUM3_AVX2_polyveck_freeze(polyveck *v);
 
 void PQCLEAN_DILITHIUM3_AVX2_polyveck_add(polyveck *w, const polyveck *u, const polyveck *v);
 void PQCLEAN_DILITHIUM3_AVX2_polyveck_sub(polyveck *w, const polyveck *u, const polyveck *v);

src/sign/dilithium/dilithium3/avx2/rejsample.h

@@ -7,13 +7,13 @@
 #define REJ_UNIFORM_NBLOCKS ((768+STREAM128_BLOCKBYTES-1)/STREAM128_BLOCKBYTES)
 #define REJ_UNIFORM_BUFLEN (REJ_UNIFORM_NBLOCKS*STREAM128_BLOCKBYTES)
 
-#define REJ_UNIFORM_ETA_NBLOCKS ((228+STREAM128_BLOCKBYTES-1)/STREAM128_BLOCKBYTES)
-#define REJ_UNIFORM_ETA_BUFLEN (REJ_UNIFORM_ETA_NBLOCKS*STREAM128_BLOCKBYTES)
+#define REJ_UNIFORM_ETA_NBLOCKS ((227+STREAM256_BLOCKBYTES-1)/STREAM256_BLOCKBYTES)
+#define REJ_UNIFORM_ETA_BUFLEN (REJ_UNIFORM_ETA_NBLOCKS*STREAM256_BLOCKBYTES)
 
 extern const uint8_t PQCLEAN_DILITHIUM3_AVX2_idxlut[256][8];
 
 unsigned int PQCLEAN_DILITHIUM3_AVX2_rej_uniform_avx(int32_t *r, const uint8_t buf[REJ_UNIFORM_BUFLEN + 8]);
 
-unsigned int PQCLEAN_DILITHIUM3_AVX2_rej_eta_avx(int32_t *r, const uint8_t buf[REJ_UNIFORM_BUFLEN]);
+unsigned int PQCLEAN_DILITHIUM3_AVX2_rej_eta_avx(int32_t *r, const uint8_t buf[REJ_UNIFORM_ETA_BUFLEN]);
 
 #endif

src/sign/dilithium/dilithium3/avx2/sign.c

@@ -53,7 +53,7 @@ static inline void polyvec_matrix_expand_row(polyvecl **row, polyvecl buf[2], co
 **************************************************/
 int PQCLEAN_DILITHIUM3_AVX2_crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
     unsigned int i;
-    uint8_t seedbuf[3 * SEEDBYTES];
+    uint8_t seedbuf[2 * SEEDBYTES + CRHBYTES];
     const uint8_t *rho, *rhoprime, *key;
     polyvecl rowbuf[2];
     polyvecl s1, *row = rowbuf;
@@ -62,10 +62,10 @@ int PQCLEAN_DILITHIUM3_AVX2_crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
 
     /* Get randomness for rho, rhoprime and key */
     randombytes(seedbuf, SEEDBYTES);
-    shake256(seedbuf, 3 * SEEDBYTES, seedbuf, SEEDBYTES);
+    shake256(seedbuf, 2 * SEEDBYTES + CRHBYTES, seedbuf, SEEDBYTES);
     rho = seedbuf;
-    rhoprime = seedbuf + SEEDBYTES;
-    key = seedbuf + 2 * SEEDBYTES;
+    rhoprime = rho + SEEDBYTES;
+    key = rhoprime + CRHBYTES;
 
     /* Store rho, key */
     memcpy(pk, rho, SEEDBYTES);
@@ -79,10 +79,10 @@ int PQCLEAN_DILITHIUM3_AVX2_crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
 
     /* Pack secret vectors */
     for (i = 0; i < L; i++) {
-        PQCLEAN_DILITHIUM3_AVX2_polyeta_pack(sk + 2 * SEEDBYTES + CRHBYTES + i * POLYETA_PACKEDBYTES, &s1.vec[i]);
+        PQCLEAN_DILITHIUM3_AVX2_polyeta_pack(sk + 3 * SEEDBYTES + i * POLYETA_PACKEDBYTES, &s1.vec[i]);
     }
     for (i = 0; i < K; i++) {
-        PQCLEAN_DILITHIUM3_AVX2_polyeta_pack(sk + 2 * SEEDBYTES + CRHBYTES + (L + i)*POLYETA_PACKEDBYTES, &s2.vec[i]);
+        PQCLEAN_DILITHIUM3_AVX2_polyeta_pack(sk + 3 * SEEDBYTES + (L + i)*POLYETA_PACKEDBYTES, &s2.vec[i]);
     }
 
     /* Transform s1 */
@@ -104,11 +104,11 @@ int PQCLEAN_DILITHIUM3_AVX2_crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
         PQCLEAN_DILITHIUM3_AVX2_poly_caddq(&t1);
         PQCLEAN_DILITHIUM3_AVX2_poly_power2round(&t1, &t0, &t1);
         PQCLEAN_DILITHIUM3_AVX2_polyt1_pack(pk + SEEDBYTES + i * POLYT1_PACKEDBYTES, &t1);
-        PQCLEAN_DILITHIUM3_AVX2_polyt0_pack(sk + 2 * SEEDBYTES + CRHBYTES + (L + K)*POLYETA_PACKEDBYTES + i * POLYT0_PACKEDBYTES, &t0);
+        PQCLEAN_DILITHIUM3_AVX2_polyt0_pack(sk + 3 * SEEDBYTES + (L + K)*POLYETA_PACKEDBYTES + i * POLYT0_PACKEDBYTES, &t0);
     }
 
-    /* Compute CRH(rho, t1) and store in secret key */
-    crh(sk + 2 * SEEDBYTES, pk, PQCLEAN_DILITHIUM3_AVX2_CRYPTO_PUBLICKEYBYTES);
+    /* Compute H(rho, t1) and store in secret key */
+    shake256(sk + 2 * SEEDBYTES, SEEDBYTES, pk, PQCLEAN_DILITHIUM3_AVX2_CRYPTO_PUBLICKEYBYTES);
 
     return 0;
 }
@@ -128,7 +128,7 @@ int PQCLEAN_DILITHIUM3_AVX2_crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
 **************************************************/
 int PQCLEAN_DILITHIUM3_AVX2_crypto_sign_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen, const uint8_t *sk) {
     unsigned int i, n, pos;
-    uint8_t seedbuf[2 * SEEDBYTES + 3 * CRHBYTES];
+    uint8_t seedbuf[3 * SEEDBYTES + 2 * CRHBYTES];
     uint8_t *rho, *tr, *key, *mu, *rhoprime;
     uint8_t hintbuf[N];
     uint8_t *hint = sig + SEEDBYTES + L * POLYZ_PACKEDBYTES;
@@ -144,20 +144,20 @@ int PQCLEAN_DILITHIUM3_AVX2_crypto_sign_signature(uint8_t *sig, size_t *siglen,
 
     rho = seedbuf;
     tr = rho + SEEDBYTES;
-    key = tr + CRHBYTES;
+    key = tr + SEEDBYTES;
     mu = key + SEEDBYTES;
     rhoprime = mu + CRHBYTES;
     PQCLEAN_DILITHIUM3_AVX2_unpack_sk(rho, tr, key, &t0, &s1, &s2, sk);
 
     /* Compute CRH(tr, msg) */
     shake256_inc_init(&state);
-    shake256_inc_absorb(&state, tr, CRHBYTES);
+    shake256_inc_absorb(&state, tr, SEEDBYTES);
     shake256_inc_absorb(&state, m, mlen);
     shake256_inc_finalize(&state);
     shake256_inc_squeeze(mu, CRHBYTES, &state);
     shake256_inc_ctx_release(&state);
 
-    crh(rhoprime, key, SEEDBYTES + CRHBYTES);
+    shake256(rhoprime, CRHBYTES, key, SEEDBYTES + CRHBYTES);
 
     /* Expand matrix and transform vectors */
     PQCLEAN_DILITHIUM3_AVX2_polyvec_matrix_expand(mat, rho);
@@ -303,10 +303,10 @@ int PQCLEAN_DILITHIUM3_AVX2_crypto_sign_verify(const uint8_t *sig, size_t siglen
         return -1;
     }
 
-    /* Compute CRH(CRH(rho, t1), msg) */
-    crh(mu, pk, PQCLEAN_DILITHIUM3_AVX2_CRYPTO_PUBLICKEYBYTES);
+    /* Compute CRH(H(rho, t1), msg) */
+    shake256(mu, SEEDBYTES, pk, PQCLEAN_DILITHIUM3_AVX2_CRYPTO_PUBLICKEYBYTES);
     shake256_inc_init(&state);
-    shake256_inc_absorb(&state, mu, CRHBYTES);
+    shake256_inc_absorb(&state, mu, SEEDBYTES);
     shake256_inc_absorb(&state, m, mlen);
     shake256_inc_finalize(&state);
     shake256_inc_squeeze(mu, CRHBYTES, &state);

src/sign/dilithium/dilithium3/avx2/symmetric.h

@@ -9,27 +9,18 @@
 typedef shake128incctx stream128_state;
 typedef shake256incctx stream256_state;
 
-void PQCLEAN_DILITHIUM3_AVX2_dilithium_shake128_stream_init(shake128incctx *state,
-        const uint8_t seed[SEEDBYTES],
-        uint16_t nonce);
+void PQCLEAN_DILITHIUM3_AVX2_dilithium_shake128_stream_init(shake128incctx *state, const uint8_t seed[SEEDBYTES], uint16_t nonce);
 
-void PQCLEAN_DILITHIUM3_AVX2_dilithium_shake256_stream_init(shake256incctx *state,
-        const uint8_t seed[CRHBYTES],
-        uint16_t nonce);
+void PQCLEAN_DILITHIUM3_AVX2_dilithium_shake256_stream_init(shake256incctx *state, const uint8_t seed[CRHBYTES], uint16_t nonce);
 
 #define STREAM128_BLOCKBYTES SHAKE128_RATE
 #define STREAM256_BLOCKBYTES SHAKE256_RATE
 
-#define crh(OUT, IN, INBYTES) shake256(OUT, CRHBYTES, IN, INBYTES)
-#define stream128_init(STATE, SEED, NONCE) \
-    PQCLEAN_DILITHIUM3_AVX2_dilithium_shake128_stream_init(STATE, SEED, NONCE)
-#define stream128_squeezeblocks(OUT, OUTBLOCKS, STATE) \
-    shake128_inc_squeeze(OUT, (OUTBLOCKS)*(SHAKE128_RATE), STATE)
+#define stream128_init(STATE, SEED, NONCE) PQCLEAN_DILITHIUM3_AVX2_dilithium_shake128_stream_init(STATE, SEED, NONCE)
+#define stream128_squeezeblocks(OUT, OUTBLOCKS, STATE) shake128_inc_squeeze(OUT, (OUTBLOCKS)*(SHAKE128_RATE), STATE)
 #define stream128_release(STATE) shake128_inc_ctx_release(STATE)
-#define stream256_init(STATE, SEED, NONCE) \
-    PQCLEAN_DILITHIUM3_AVX2_dilithium_shake256_stream_init(STATE, SEED, NONCE)
-#define stream256_squeezeblocks(OUT, OUTBLOCKS, STATE) \
-    shake256_inc_squeeze(OUT, (OUTBLOCKS)*(SHAKE256_RATE), STATE)
+#define stream256_init(STATE, SEED, NONCE) PQCLEAN_DILITHIUM3_AVX2_dilithium_shake256_stream_init(STATE, SEED, NONCE)
+#define stream256_squeezeblocks(OUT, OUTBLOCKS, STATE) shake256_inc_squeeze(OUT, (OUTBLOCKS)*(SHAKE256_RATE), STATE)
 #define stream256_release(STATE) shake256_inc_ctx_release(STATE)
 
 

src/sign/dilithium/dilithium3/clean/api.h

@@ -5,12 +5,11 @@
 #include <stdint.h>
 
 #define PQCLEAN_DILITHIUM3_CLEAN_CRYPTO_PUBLICKEYBYTES 1952
-#define PQCLEAN_DILITHIUM3_CLEAN_CRYPTO_SECRETKEYBYTES 4016
+#define PQCLEAN_DILITHIUM3_CLEAN_CRYPTO_SECRETKEYBYTES 4000
 #define PQCLEAN_DILITHIUM3_CLEAN_CRYPTO_BYTES 3293
 
 #define PQCLEAN_DILITHIUM3_CLEAN_CRYPTO_ALGNAME "Dilithium3"
 
-
 int PQCLEAN_DILITHIUM3_CLEAN_crypto_sign_keypair(uint8_t *pk, uint8_t *sk);
 
 int PQCLEAN_DILITHIUM3_CLEAN_crypto_sign_signature(

src/sign/dilithium/dilithium3/clean/packing.c

@@ -67,7 +67,7 @@ void PQCLEAN_DILITHIUM3_CLEAN_unpack_pk(uint8_t rho[SEEDBYTES],
 **************************************************/
 void PQCLEAN_DILITHIUM3_CLEAN_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM3_CLEAN_CRYPTO_SECRETKEYBYTES],
                                       const uint8_t rho[SEEDBYTES],
-                                      const uint8_t tr[CRHBYTES],
+                                      const uint8_t tr[SEEDBYTES],
                                       const uint8_t key[SEEDBYTES],
                                       const polyveck *t0,
                                       const polyvecl *s1,
@@ -84,10 +84,10 @@ void PQCLEAN_DILITHIUM3_CLEAN_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM3_CLEAN_CRYPTO
     }
     sk += SEEDBYTES;
 
-    for (i = 0; i < CRHBYTES; ++i) {
+    for (i = 0; i < SEEDBYTES; ++i) {
         sk[i] = tr[i];
     }
-    sk += CRHBYTES;
+    sk += SEEDBYTES;
 
     for (i = 0; i < L; ++i) {
         PQCLEAN_DILITHIUM3_CLEAN_polyeta_pack(sk + i * POLYETA_PACKEDBYTES, &s1->vec[i]);
@@ -118,7 +118,7 @@ void PQCLEAN_DILITHIUM3_CLEAN_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM3_CLEAN_CRYPTO
 *              - uint8_t sk[]: byte array containing bit-packed sk
 **************************************************/
 void PQCLEAN_DILITHIUM3_CLEAN_unpack_sk(uint8_t rho[SEEDBYTES],
-                                        uint8_t tr[CRHBYTES],
+                                        uint8_t tr[SEEDBYTES],
                                         uint8_t key[SEEDBYTES],
                                         polyveck *t0,
                                         polyvecl *s1,
@@ -136,10 +136,10 @@ void PQCLEAN_DILITHIUM3_CLEAN_unpack_sk(uint8_t rho[SEEDBYTES],
     }
     sk += SEEDBYTES;
 
-    for (i = 0; i < CRHBYTES; ++i) {
+    for (i = 0; i < SEEDBYTES; ++i) {
         tr[i] = sk[i];
     }
-    sk += CRHBYTES;
+    sk += SEEDBYTES;
 
     for (i = 0; i < L; ++i) {
         PQCLEAN_DILITHIUM3_CLEAN_polyeta_unpack(&s1->vec[i], sk + i * POLYETA_PACKEDBYTES);

src/sign/dilithium/dilithium3/clean/packing.h

@@ -8,7 +8,7 @@ void PQCLEAN_DILITHIUM3_CLEAN_pack_pk(uint8_t pk[PQCLEAN_DILITHIUM3_CLEAN_CRYPTO
 
 void PQCLEAN_DILITHIUM3_CLEAN_pack_sk(uint8_t sk[PQCLEAN_DILITHIUM3_CLEAN_CRYPTO_SECRETKEYBYTES],
                                       const uint8_t rho[SEEDBYTES],
-                                      const uint8_t tr[CRHBYTES],
+                                      const uint8_t tr[SEEDBYTES],
                                       const uint8_t key[SEEDBYTES],
                                       const polyveck *t0,
                                       const polyvecl *s1,
@@ -19,7 +19,7 @@ void PQCLEAN_DILITHIUM3_CLEAN_pack_sig(uint8_t sig[PQCLEAN_DILITHIUM3_CLEAN_CRYP
 void PQCLEAN_DILITHIUM3_CLEAN_unpack_pk(uint8_t rho[SEEDBYTES], polyveck *t1, const uint8_t pk[PQCLEAN_DILITHIUM3_CLEAN_CRYPTO_PUBLICKEYBYTES]);
 
 void PQCLEAN_DILITHIUM3_CLEAN_unpack_sk(uint8_t rho[SEEDBYTES],
-                                        uint8_t tr[CRHBYTES],
+                                        uint8_t tr[SEEDBYTES],
                                         uint8_t key[SEEDBYTES],
                                         polyveck *t0,
                                         polyvecl *s1,

src/sign/dilithium/dilithium3/clean/params.h

@@ -4,7 +4,7 @@
 
 
 #define SEEDBYTES 32
-#define CRHBYTES 48
+#define CRHBYTES 64
 #define N 256
 #define Q 8380417
 #define D 13
@@ -32,7 +32,7 @@
 #define POLYETA_PACKEDBYTES 128
 
 #define PQCLEAN_DILITHIUM3_CLEAN_CRYPTO_PUBLICKEYBYTES (SEEDBYTES + K*POLYT1_PACKEDBYTES)
-#define PQCLEAN_DILITHIUM3_CLEAN_CRYPTO_SECRETKEYBYTES (2*SEEDBYTES + CRHBYTES \
+#define PQCLEAN_DILITHIUM3_CLEAN_CRYPTO_SECRETKEYBYTES (3*SEEDBYTES \
         + L*POLYETA_PACKEDBYTES \
         + K*POLYETA_PACKEDBYTES \
         + K*POLYT0_PACKEDBYTES)

src/sign/dilithium/dilithium3/clean/poly.c

@@ -47,25 +47,6 @@ void PQCLEAN_DILITHIUM3_CLEAN_poly_caddq(poly *a) {
     DBENCH_STOP(*tred);
 }
 
-/*************************************************
-* Name:        PQCLEAN_DILITHIUM3_CLEAN_poly_freeze
-*
-* Description: Inplace reduction of all coefficients of polynomial to
-*              standard representatives.
-*
-* Arguments:   - poly *a: pointer to input/output polynomial
-**************************************************/
-void PQCLEAN_DILITHIUM3_CLEAN_poly_freeze(poly *a) {
-    unsigned int i;
-    DBENCH_START();
-
-    for (i = 0; i < N; ++i) {
-        a->coeffs[i] = PQCLEAN_DILITHIUM3_CLEAN_freeze(a->coeffs[i]);
-    }
-
-    DBENCH_STOP(*tred);
-}
-
 /*************************************************
 * Name:        PQCLEAN_DILITHIUM3_CLEAN_poly_add
 *
@@ -436,28 +417,28 @@ static unsigned int rej_eta(int32_t *a,
 *              output stream from SHAKE256(seed|nonce) or AES256CTR(seed,nonce).
 *
 * Arguments:   - poly *a: pointer to output polynomial
-*              - const uint8_t seed[]: byte array with seed of length SEEDBYTES
+*              - const uint8_t seed[]: byte array with seed of length CRHBYTES
 *              - uint16_t nonce: 2-byte nonce
 **************************************************/
-#define POLY_UNIFORM_ETA_NBLOCKS ((227 + STREAM128_BLOCKBYTES - 1)/STREAM128_BLOCKBYTES)
+#define POLY_UNIFORM_ETA_NBLOCKS ((227 + STREAM256_BLOCKBYTES - 1)/STREAM256_BLOCKBYTES)
 void PQCLEAN_DILITHIUM3_CLEAN_poly_uniform_eta(poly *a,
-        const uint8_t seed[SEEDBYTES],
+        const uint8_t seed[CRHBYTES],
         uint16_t nonce) {
     unsigned int ctr;
-    unsigned int buflen = POLY_UNIFORM_ETA_NBLOCKS * STREAM128_BLOCKBYTES;
-    uint8_t buf[POLY_UNIFORM_ETA_NBLOCKS * STREAM128_BLOCKBYTES];
-    stream128_state state;
+    unsigned int buflen = POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES;
+    uint8_t buf[POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES];
+    stream256_state state;
 
-    stream128_init(&state, seed, nonce);
-    stream128_squeezeblocks(buf, POLY_UNIFORM_ETA_NBLOCKS, &state);
+    stream256_init(&state, seed, nonce);
+    stream256_squeezeblocks(buf, POLY_UNIFORM_ETA_NBLOCKS, &state);
 
     ctr = rej_eta(a->coeffs, N, buf, buflen);
 
     while (ctr < N) {
-        stream128_squeezeblocks(buf, 1, &state);
-        ctr += rej_eta(a->coeffs + ctr, N - ctr, buf, STREAM128_BLOCKBYTES);
+        stream256_squeezeblocks(buf, 1, &state);
+        ctr += rej_eta(a->coeffs + ctr, N - ctr, buf, STREAM256_BLOCKBYTES);
     }
-    stream128_release(&state);
+    stream256_release(&state);
 }
 
 /*************************************************

src/sign/dilithium/dilithium3/clean/poly.h

@@ -9,7 +9,6 @@ typedef struct {
 
 void PQCLEAN_DILITHIUM3_CLEAN_poly_reduce(poly *a);
 void PQCLEAN_DILITHIUM3_CLEAN_poly_caddq(poly *a);
-void PQCLEAN_DILITHIUM3_CLEAN_poly_freeze(poly *a);
 
 void PQCLEAN_DILITHIUM3_CLEAN_poly_add(poly *c, const poly *a, const poly *b);
 void PQCLEAN_DILITHIUM3_CLEAN_poly_sub(poly *c, const poly *a, const poly *b);
@@ -29,7 +28,7 @@ void PQCLEAN_DILITHIUM3_CLEAN_poly_uniform(poly *a,
         const uint8_t seed[SEEDBYTES],
         uint16_t nonce);
 void PQCLEAN_DILITHIUM3_CLEAN_poly_uniform_eta(poly *a,
-        const uint8_t seed[SEEDBYTES],
+        const uint8_t seed[CRHBYTES],
         uint16_t nonce);
 void PQCLEAN_DILITHIUM3_CLEAN_poly_uniform_gamma1(poly *a,
         const uint8_t seed[CRHBYTES],

src/sign/dilithium/dilithium3/clean/polyvec.c

@@ -36,7 +36,7 @@ void PQCLEAN_DILITHIUM3_CLEAN_polyvec_matrix_pointwise_montgomery(polyveck *t, c
 /************ Vectors of polynomials of length L **************/
 /**************************************************************/
 
-void PQCLEAN_DILITHIUM3_CLEAN_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
+void PQCLEAN_DILITHIUM3_CLEAN_polyvecl_uniform_eta(polyvecl *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
     unsigned int i;
 
     for (i = 0; i < L; ++i) {
@@ -60,22 +60,6 @@ void PQCLEAN_DILITHIUM3_CLEAN_polyvecl_reduce(polyvecl *v) {
     }
 }
 
-/*************************************************
-* Name:        PQCLEAN_DILITHIUM3_CLEAN_polyvecl_freeze
-*
-* Description: Reduce coefficients of polynomials in vector of length L
-*              to standard representatives.
-*
-* Arguments:   - polyvecl *v: pointer to input/output vector
-**************************************************/
-void PQCLEAN_DILITHIUM3_CLEAN_polyvecl_freeze(polyvecl *v) {
-    unsigned int i;
-
-    for (i = 0; i < L; ++i) {
-        PQCLEAN_DILITHIUM3_CLEAN_poly_freeze(&v->vec[i]);
-    }
-}
-
 /*************************************************
 * Name:        PQCLEAN_DILITHIUM3_CLEAN_polyvecl_add
 *
@@ -178,7 +162,7 @@ int PQCLEAN_DILITHIUM3_CLEAN_polyvecl_chknorm(const polyvecl *v, int32_t bound)
 /************ Vectors of polynomials of length K **************/
 /**************************************************************/
 
-void PQCLEAN_DILITHIUM3_CLEAN_polyveck_uniform_eta(polyveck *v, const uint8_t seed[SEEDBYTES], uint16_t nonce) {
+void PQCLEAN_DILITHIUM3_CLEAN_polyveck_uniform_eta(polyveck *v, const uint8_t seed[CRHBYTES], uint16_t nonce) {
     unsigned int i;
 
     for (i = 0; i < K; ++i) {
@@ -218,22 +202,6 @@ void PQCLEAN_DILITHIUM3_CLEAN_polyveck_caddq(polyveck *v) {
     }
 }
 
-/*************************************************
-* Name:        PQCLEAN_DILITHIUM3_CLEAN_polyveck_freeze
-*
-* Description: Reduce coefficients of polynomials in vector of length K
-*              to standard representatives.
-*
-* Arguments:   - polyveck *v: pointer to input/output vector
-**************************************************/
-void PQCLEAN_DILITHIUM3_CLEAN_polyveck_freeze(polyveck *v)  {
-    unsigned int i;
-
-    for (i = 0; i < K; ++i) {
-        PQCLEAN_DILITHIUM3_CLEAN_poly_freeze(&v->vec[i]);
-    }
-}
-
 /*************************************************
 * Name:        PQCLEAN_DILITHIUM3_CLEAN_polyveck_add
 *