kpqc 0.1.0 → 0.2.0

data/vendor/HAETAE/src/poly.c

@@ -181,7 +181,7 @@ void poly_lsb(poly *a0, const poly *a) {
  *              HAETAE_SEEDBYTES
  *              - uint16_t nonce: 2-byte nonce
  *
- * Specification: Implements Algorithm 6, PolyUniform.
+ * Specification: Implements @[Algorithm 8, PolyUniform]
  **************************************************/
 #define POLY_UNIFORM_NBLOCKS                                                   \
   ((512 + STREAM128_BLOCKBYTES - 1) / STREAM128_BLOCKBYTES)
@@ -222,7 +222,7 @@ void poly_uniform(poly *a, const uint8_t seed[HAETAE_SEEDBYTES],
  *              HAETAE_CRHBYTES
  *              - uint16_t nonce: 2-byte nonce
  *
- * Specification: Implements Algorithm 9, PolyUniformEta.
+ * Specification: Implements @[Algorithm 11, PolyUniformEta]
  **************************************************/
 #define POLY_UNIFORM_ETA_NBLOCKS                                               \
   ((136 + STREAM256_BLOCKBYTES - 1) / STREAM256_BLOCKBYTES) // 1
@@ -263,7 +263,7 @@ uint8_t hammingWeight_8(uint8_t x) {
  *              - const uint8_t highbits_lsb[]: packed highbits and lsb
  *              - const uint8_t mu[]: hash of vk and message
  *
- * Specification: Implements Algorithm 16, SampleChallenge.
+ * Specification: Implements @[Algorithm 18, SampleChallenge]
  **************************************************/
 void poly_challenge(
     poly *c,
@@ -345,6 +345,20 @@ void poly_decomposed_unpack(poly *a, const uint8_t *buf) {
   }
 }
 
+/*************************************************
+ * Name:        poly_fromcrt
+ *
+ * Description: Compute coefficient-wise inverse CRT from the "mod q"
+ *              polynomial u and the "mod 2" polynomial v: if the LSBs of the
+ *              two coefficients agree, keep the "mod q" coefficient, otherwise
+ *              add q. Output coefficients lie in [0, 2q-1].
+ *
+ * Arguments:   - poly *w: pointer to output polynomial
+ *              - const poly *u: pointer to input polynomial ("mod q")
+ *              - const poly *v: pointer to input polynomial ("mod 2")
+ *
+ * Specification: Implements @[Algorithm 4, poly_fromcrt]
+ **************************************************/
 void poly_fromcrt(poly *w, const poly *u, const poly *v) {
   unsigned int i;
   int32_t xq, x2;
@@ -356,6 +370,19 @@ void poly_fromcrt(poly *w, const poly *u, const poly *v) {
   }
 }
 
+/*************************************************
+ * Name:        poly_fromcrt0
+ *
+ * Description: Compute coefficient-wise inverse CRT from the "mod q"
+ *              polynomial u, assuming the "mod 2" polynomial is zero: if the
+ *              LSB of a coefficient is zero, keep it, otherwise add q. Output
+ *              coefficients lie in [0, 2q-1].
+ *
+ * Arguments:   - poly *w: pointer to output polynomial
+ *              - const poly *u: pointer to input polynomial ("mod q")
+ *
+ * Specification: Implements @[Algorithm 5, poly_fromcrt0]
+ **************************************************/
 void poly_fromcrt0(poly *w, const poly *u) {
   unsigned int i;
   int32_t xq;

data/vendor/HAETAE/src/polyfix.c

@@ -234,7 +234,7 @@ uint64_t polyfixveclk_sqnorm2(const polyfixvecl *a, const polyfixveck *b) {
  *              - uint8_t seed[HAETAE_CRHBYTES]: input seed bytes
  *              - const uint16_t nonce: input nonce
  *
- * Specification: Implements Algorithm 11, SampleHyperBall.
+ * Specification: Implements @[Algorithm 13, SampleHyperball]
  **************************************************/
 uint16_t polyfixveclk_sample_hyperball(polyfixvecl *y1, polyfixveck *y2,
                                        uint8_t *b,
@@ -264,7 +264,7 @@ uint16_t polyfixveclk_sample_hyperball(polyfixvecl *y1, polyfixveck *y2,
     sqsum.limb48[0] += (sqsum.limb48[1] & 1) << 47;
     sqsum.limb48[1] >>= 1;
     sqsum.limb48[1] += sqsum.limb48[0] >> 48;
-    sqsum.limb48[0] &= (1ULL << 48) - 1;
+    sqsum.limb48[0] &= (UINT64_C(1) << 48) - 1;
     fixpoint_newton_invsqrt(&invsqrt, &sqsum);
     fixpoint_mul_high(&sqsum, &invsqrt,
                       (uint64_t)(HAETAE_B0 * HAETAE_LN + HAETAE_SQNM / 2)

data/vendor/HAETAE/src/polymat.c

@@ -18,7 +18,7 @@
  * Arguments:   - polyvecm mat[HAETAE_K]: output matrix k \times m
  *              - const uint8_t rho[]: byte array containing seed rho
  *
- * Specification: Implements Algorithm 4, ExpandMatA.
+ * Specification: Implements @[Algorithm 6, ExpandMatA]
  **************************************************/
 void polymatkl_expand_matA(polyvecl mat[HAETAE_K],
                            const uint8_t rho[HAETAE_SEEDBYTES]) {
@@ -40,7 +40,7 @@ void polymatkl_expand_matA(polyvecl mat[HAETAE_K],
  * Arguments:   - polyvecm mat[HAETAE_K]: output matrix k \times m
  *              - const uint8_t rho[]: byte array containing seed rho
  *
- * Specification: Implements Algorithm 4, ExpandMatA.
+ * Specification: Implements @[Algorithm 6, ExpandMatA]
  **************************************************/
 void polymatkm_expand_matA(polyvecm mat[HAETAE_K],
                            const uint8_t rho[HAETAE_SEEDBYTES]) {

data/vendor/HAETAE/src/polyvec.c

@@ -117,7 +117,7 @@ void polyveck_freeze2q(polyveck *v) {
  *              - const uint8_t seed[]: byte array with seed of length
  *              HAETAE_SEEDBYTES
  *
- * Specification: Implements Algorithm 5, ExpandVec_a.
+ * Specification: Implements @[Algorithm 7, ExpandVeca]
  **************************************************/
 void polyveck_expand_vecA(polyveck *v, const uint8_t seed[HAETAE_SEEDBYTES]) {
   unsigned int i, nonce = (HAETAE_K << 8) + HAETAE_M;
@@ -138,7 +138,7 @@ void polyveck_expand_vecA(polyveck *v, const uint8_t seed[HAETAE_SEEDBYTES]) {
  *              HAETAE_CRHBYTES
  *              - uint16_t nonce: 2-byte nonce
  *
- * Specification: Implements Algorithm 8, ExpandS.
+ * Specification: Implements @[Algorithm 10, ExpandS]
  **************************************************/
 void polyvecmk_expand_S(polyvecm *u, polyveck *v,
                         const uint8_t seed[HAETAE_CRHBYTES], uint16_t nonce) {
@@ -203,6 +203,8 @@ void polyveck_poly_pointwise_montgomery(polyveck *w, const polyveck *u,
  *              - const polyveck *u: pointer to the input vector of polynomials
  *              of length HAETAE_K
  *              - const poly *v: pointer to the input polynomial ("mod 2")
+ *
+ * Specification: Implements @[Algorithm 3, iCRT]
  **************************************************/
 void polyveck_poly_fromcrt(polyveck *w, const polyveck *u, const poly *v) {
   unsigned int i;
@@ -451,7 +453,7 @@ void polyvecm_ntt(polyvecm *x) {
  * Arguments:   - int32_t *x: pointer to first input/output integer
  *              - int32_t *y: pointer to second input/output integer
  *
- * Specification: Implements Algorithm 44, minmax.
+ * Specification: Implements @[Algorithm 50, minmax]
  * **************************************************/
 static inline void minmax(int32_t *x, int32_t *y) // taken from djbsort
 {
@@ -475,7 +477,7 @@ static inline void minmax(int32_t *x, int32_t *y) // taken from djbsort
  *
  * Returns:
  *
- * Specification: Implements Algorithm 42, skSingularValue.
+ * Specification: Implements @[Algorithm 48, skSingularValue]
  **************************************************/
 int64_t polyvecmk_sk_singular_value(const polyvecm *s1, const polyveck *s2) {
   int32_t res = 0;
@@ -520,7 +522,7 @@ int64_t polyvecmk_sk_singular_value(const polyvecm *s1, const polyveck *s2) {
   for (size_t i = 0; i < HAETAE_N / HAETAE_TAU + 1; i++) {
     int32_t fac =
         ((min - bestm[i]) >>
-         31); // all-ones if bestm[i] != min
+         31); // all-ones if bestm[i] != min (TODO: impl specific behaviour)
     fac = (fac & (HAETAE_TAU)) ^
           ((~fac) & (HAETAE_N % HAETAE_TAU)); // fac = HAETAE_TAU for all != min
                                               // and N%HAETAE_TAU for min

data/vendor/HAETAE/src/reduce.c

@@ -15,6 +15,8 @@
  * Arguments:   - int64_t: finite field element a
  *
  * Returns r.
+ *
+ * Specification: Implements @[Algorithm 1, MontgomeryReduce]
  **************************************************/
 int32_t montgomery_reduce(int64_t a) {
   int32_t t;

data/vendor/HAETAE/src/sampler.c

@@ -20,7 +20,7 @@
  * Returns number of sampled coefficients. Can be smaller than len if not enough
  * random bytes were given.
  *
- * Specification: Implements Algorithm 7, RejUniform.
+ * Specification: Implements @[Algorithm 9, RejUniform]
  **************************************************/
 unsigned int rej_uniform(int32_t *a, unsigned int len, const uint8_t *buf,
                          unsigned int buflen) {
@@ -53,7 +53,7 @@ unsigned int rej_uniform(int32_t *a, unsigned int len, const uint8_t *buf,
  * Returns number of sampled coefficients. Can be smaller than len if not enough
  * random bytes were given.
  *
- * Specification: Implements Algorithm 10, RejEta.
+ * Specification: Implements @[Algorithm 12, RejEta]
  **************************************************/
 static int32_t mod3(uint8_t t) {
   int32_t r;
@@ -119,43 +119,214 @@ unsigned int rej_eta(int32_t *a, unsigned int len, const uint8_t *buf,
   return ctr;
 }
 
-static uint64_t approx_exp(const uint64_t x) {
-  int64_t result;
-  result = -0x0000B6C6340925AELL;
-  result = ((smulh48(result, x) + (1LL << 2)) >> 3) + 0x0000B4BD4DF85227LL;
-  result = ((smulh48(result, x) + (1LL << 2)) >> 3) - 0x0000887F727491E2LL;
-  result = ((smulh48(result, x) + (1LL << 1)) >> 2) + 0x0000AAAA643C7E8DLL;
-  result = ((smulh48(result, x) + (1LL << 1)) >> 2) - 0x0000AAAAA98179E6LL;
-  result = ((smulh48(result, x) + 1LL) >> 1) + 0x0000FFFFFFFB2E7ALL;
-  result = ((smulh48(result, x) + 1LL) >> 1) - 0x0000FFFFFFFFF85FLL;
-  result = ((smulh48(result, x))) + 0x0000FFFFFFFFFFFCLL;
-  return result;
+/*
+ * GALACTICS [Rossi23]: degree-10 polynomial P(z) for exp(-z), z = xi/2^48.
+ *
+ * The constant term c_0 is lifted by +1 unit (2^{-48}) to enforce the ceiling
+ * condition P_c(z) ≥ exp(-z) everywhere.
+ *
+ * GALACTICS rational coefficients  c_k = integer * 2^{exponent}:
+ *   c_0  =                1 * 2^0     (= 1 exactly)
+ *   c_1  = -140737488355325 * 2^{-47}
+ *   c_2  =  140737488354861 * 2^{-48}
+ *   c_3  =   -5864062013275 * 2^{-45}
+ *   c_4  =   93824990983603 * 2^{-51}
+ *   c_5  =  -75059957176683 * 2^{-53}
+ *   c_6  =   50039335827767 * 2^{-55}
+ *   c_7  = -114346678051053 * 2^{-59}
+ *   c_8  =   56962476261175 * 2^{-61}
+ *   c_9  =  -24365119391573 * 2^{-63}
+ *   c_10 =   14645656383309 * 2^{-66}
+ *
+ * Integer coefficients c_k^int = ceil(c_k * 2^48):
+ *   c_0^int  = 281474976710657  [GALACTICS-C: 2^48+1; lifted by +1]
+ *   c_1^int  =-281474976710650  [exact]
+ *   c_2^int  = 140737488354861  [exact]
+ *   c_3^int  = -46912496106200  [exact]
+ *   c_4^int  =  11728123872951  [ceil(11728123872950.375)]
+ *   c_5^int  =  -2345623661771  [ceil(-2345623661771.344)]
+ *   c_6^int  =    390932311155  [ceil(390932311154.430)]
+ *   c_7^int  =    -55833338892  [ceil(-55833338892.116)]
+ *   c_8^int  =      6953427278  [ceil(6953427277.975)]
+ *   c_9^int  =      -743564434  [ceil(-743564434.557)]
+ *   c_10^int =        55868746  [ceil(55868745.359)]
+ */
+static uint64_t approx_exp(const uint64_t xi) {
+  int64_t r = INT64_C(55868746);                 /* c_10^int */
+  r = smulh48(r, xi) - INT64_C(743564434);       /* c_9^int  */
+  r = smulh48(r, xi) + INT64_C(6953427278);      /* c_8^int  */
+  r = smulh48(r, xi) - INT64_C(55833338892);     /* c_7^int  */
+  r = smulh48(r, xi) + INT64_C(390932311155);    /* c_6^int  */
+  r = smulh48(r, xi) - INT64_C(2345623661771);   /* c_5^int  */
+  r = smulh48(r, xi) + INT64_C(11728123872951);  /* c_4^int  */
+  r = smulh48(r, xi) - INT64_C(46912496106200);  /* c_3^int  */
+  r = smulh48(r, xi) + INT64_C(140737488354861); /* c_2^int  */
+  r = smulh48(r, xi) - INT64_C(281474976710650); /* c_1^int  */
+  r = smulh48(r, xi) + INT64_C(281474976710657); /* c_0^int  */
+  return (uint64_t)r;
 }
 
-#define CDTLEN 64
-static const uint32_t CDT[CDTLEN] = {
-    3266,  6520,  9748,  12938, 16079, 19159, 22168, 25096, 27934, 30674, 33309,
-    35833, 38241, 40531, 42698, 44742, 46663, 48460, 50135, 51690, 53128, 54454,
-    55670, 56781, 57794, 58712, 59541, 60287, 60956, 61554, 62085, 62556, 62972,
-    63337, 63657, 63936, 64178, 64388, 64569, 64724, 64857, 64970, 65066, 65148,
-    65216, 65273, 65321, 65361, 65394, 65422, 65444, 65463, 65478, 65490, 65500,
-    65508, 65514, 65519, 65523, 65527, 65529, 65531, 65533, 65534};
+#define CDTLEN 166
+#define CDTHILEN 76
+
+/*
+ * 83-bit CDT for D_{Z,16} half-Gaussian: rho(k) = exp(-k^2/512), k >= 0
+ * CDT83[k] = floor(CDF(k) * 2^83) where CDF(k) = sum_{j=0}^{k} rho(j)/Z_half
+ * Z_half = sum_{k=0}^{inf} exp(-k^2/512) = 20.5530...
+ * Split: CDT83_HI[k] = CDT83[k] >> 64 (upper 19 bits)
+ *        CDT83_LO[k] = CDT83[k] & 0xFFFFFFFFFFFFFFFF (lower 64 bits)
+ */
+
+static const uint32_t CDT83_HI[CDTHILEN] = {
+    UINT32_C(0x063a5), UINT32_C(0x0c718), UINT32_C(0x129f6), UINT32_C(0x18bdf),
+    UINT32_C(0x1ec73), UINT32_C(0x24b59), UINT32_C(0x2a83a), UINT32_C(0x302c6),
+    UINT32_C(0x35ab6), UINT32_C(0x3afc7), UINT32_C(0x401be), UINT32_C(0x4506a),
+    UINT32_C(0x49ba1), UINT32_C(0x4e343), UINT32_C(0x52736), UINT32_C(0x5676c),
+    UINT32_C(0x5a3dc), UINT32_C(0x5dc86), UINT32_C(0x61172), UINT32_C(0x642ad),
+    UINT32_C(0x6704c), UINT32_C(0x69a68), UINT32_C(0x6c120), UINT32_C(0x6e496),
+    UINT32_C(0x704ef), UINT32_C(0x72255), UINT32_C(0x73cf1), UINT32_C(0x754f0),
+    UINT32_C(0x76a7c), UINT32_C(0x77dc4), UINT32_C(0x78ef2), UINT32_C(0x79e32),
+    UINT32_C(0x7abaf), UINT32_C(0x7b78f), UINT32_C(0x7c1fb), UINT32_C(0x7cb17),
+    UINT32_C(0x7d304), UINT32_C(0x7d9e4), UINT32_C(0x7dfd4), UINT32_C(0x7e4f0),
+    UINT32_C(0x7e950), UINT32_C(0x7ed0d), UINT32_C(0x7f03b), UINT32_C(0x7f2ec),
+    UINT32_C(0x7f531), UINT32_C(0x7f71a), UINT32_C(0x7f8b3), UINT32_C(0x7fa08),
+    UINT32_C(0x7fb24), UINT32_C(0x7fc0e), UINT32_C(0x7fccf), UINT32_C(0x7fd6e),
+    UINT32_C(0x7fdf0), UINT32_C(0x7fe5a), UINT32_C(0x7feaf), UINT32_C(0x7fef5),
+    UINT32_C(0x7ff2c), UINT32_C(0x7ff59), UINT32_C(0x7ff7d), UINT32_C(0x7ff99),
+    UINT32_C(0x7ffb0), UINT32_C(0x7ffc2), UINT32_C(0x7ffd0), UINT32_C(0x7ffdb),
+    UINT32_C(0x7ffe3), UINT32_C(0x7ffea), UINT32_C(0x7ffef), UINT32_C(0x7fff3),
+    UINT32_C(0x7fff6), UINT32_C(0x7fff8), UINT32_C(0x7fffa), UINT32_C(0x7fffb),
+    UINT32_C(0x7fffd), UINT32_C(0x7fffd), UINT32_C(0x7fffe), UINT32_C(0x7fffe),
+};
+
+static const uint64_t CDT83_LO[CDTLEN] = {
+    UINT64_C(0x0aa572bc88db1e28), UINT64_C(0x4f3820e69064b2ee),
+    UINT64_C(0xd68dc44dd1418704), UINT64_C(0x6587a04d9b97b1dd),
+    UINT64_C(0x9b843ce0a65d0050), UINT64_C(0x02b62cb869003e7d),
+    UINT64_C(0x0d44f194f8bf43c6), UINT64_C(0xfaa0c7acb211b4db),
+    UINT64_C(0xa11387f7f524be80), UINT64_C(0x18526ca6f2ceb77f),
+    UINT64_C(0x42a01a906b7dad17), UINT64_C(0x32e5337a1966b9a7),
+    UINT64_C(0x6f00f7ac9735f58a), UINT64_C(0x0e6c48f40642ba60),
+    UINT64_C(0xb6192fa1afb5e4ec), UINT64_C(0x7339dba8ffc2fcf5),
+    UINT64_C(0x7746cbe1ac90c9eb), UINT64_C(0xb83004341d78466f),
+    UINT64_C(0x781dcca572bb3d8a), UINT64_C(0xb880376cc82a5384),
+    UINT64_C(0x9c68a5c477dfecb9), UINT64_C(0xbe45ceb02a25fef3),
+    UINT64_C(0x7d1a8ccd208dbaa1), UINT64_C(0x452c002b9085e7db),
+    UINT64_C(0xd7ef361c5551378d), UINT64_C(0x96b4ff49d9e5a8bb),
+    UINT64_C(0xd337c94ede732d83), UINT64_C(0x28c75b8d3fe83c38),
+    UINT64_C(0xe05d7bd130fe20e0), UINT64_C(0x6170e60b76d85108),
+    UINT64_C(0xb0e59892414901ff), UINT64_C(0xff05cf70b911f3de),
+    UINT64_C(0x4501460fdfd508c9), UINT64_C(0xf20b1303a2a54906),
+    UINT64_C(0xa7d3badbeb04b20c), UINT64_C(0x05ce666b741b666d),
+    UINT64_C(0x826e689fded20430), UINT64_C(0x5155d1354fcf6ff6),
+    UINT64_C(0x55469226a1d318f6), UINT64_C(0x1c8d3820cfa9cabc),
+    UINT64_C(0xe68d83bbf700fc40), UINT64_C(0xb1152d8944042803),
+    UINT64_C(0x4c1e741aabe53700), UINT64_C(0x72b94c56e0f9a967),
+    UINT64_C(0xe7e5a80a79e4539c), UINT64_C(0x9641c5d11feb4d12),
+    UINT64_C(0xb18b71598b73dde0), UINT64_C(0xd9112fb5a7904d7e),
+    UINT64_C(0x3a4f57cbefabc820), UINT64_C(0xb314025fd5022976),
+    UINT64_C(0xf2a2b228aab1981b), UINT64_C(0x996ce1e60378cd98),
+    UINT64_C(0x570ec64b38e3ca90), UINT64_C(0x0657269615dcd7c6),
+    UINT64_C(0xc7360038bdc85312), UINT64_C(0x167fa02a57a8ae1a),
+    UINT64_C(0xe380fab2ea9b2bef), UINT64_C(0xa36e6abd6509b5a2),
+    UINT64_C(0x62bfcf1d6ba81c37), UINT64_C(0xd4946e8bf96caa93),
+    UINT64_C(0x603e6262ea8cda2d), UINT64_C(0x2d18c8b333ae9203),
+    UINT64_C(0x2ccdedb5a7718d61), UINT64_C(0x24333ecab8497c0a),
+    UINT64_C(0xb2e06eb33bf2b7d9), UINT64_C(0x59a5f6c550dfe7e2),
+    UINT64_C(0x800548f3927f906e), UINT64_C(0x78cac146b573bc40),
+    UINT64_C(0x85e6dadec4b6aff1), UINT64_C(0xdba17dfa17def8ec),
+    UINT64_C(0xa33f84d06ce20a93), UINT64_C(0xfd2fe967c5186746),
+    UINT64_C(0x02d37ecd7e9b180f), UINT64_C(0xc7efafa8bd33f0bb),
+    UINT64_C(0x5bda826341e791cc), UINT64_C(0xca6c1c6ce045599f),
+    UINT64_C(0x1cc02c0faa9a526e), UINT64_C(0x59d002901a4a4e52),
+    UINT64_C(0x86ecbd139ce07540), UINT64_C(0xa81f9f15ffb47f4c),
+    UINT64_C(0xc075b17481687af0), UINT64_C(0xd23ad13e68301c65),
+    UINT64_C(0xdf27955fae1c84cb), UINT64_C(0xe884cdb07368c266),
+    UINT64_C(0xef46d4f897fc83f6), UINT64_C(0xf4227e46663ec049),
+    UINT64_C(0xf79d091c1b5aff07), UINT64_C(0xfa183c533c3890a6),
+    UINT64_C(0xfbdb8a602066b0f2), UINT64_C(0xfd1af06df3db86b7),
+    UINT64_C(0xfdfc1a818587e2aa), UINT64_C(0xfe9a37a348ac2a93),
+    UINT64_C(0xff08d0797970dbfe), UINT64_C(0xff55df73fd7a00bc),
+    UINT64_C(0xff8b5aa573bca5ce), UINT64_C(0xffb053c109f51681),
+    UINT64_C(0xffc9c9bd39a036ec), UINT64_C(0xffdb40bd4ee1f846),
+    UINT64_C(0xffe72fa859b20a4a), UINT64_C(0xffef4edda93d266d),
+    UINT64_C(0xfff4d07a9fb0d4e0), UINT64_C(0xfff88868ef31b1cc),
+    UINT64_C(0xfffb08c16a3f5f0c), UINT64_C(0xfffcb5d30be5cabf),
+    UINT64_C(0xfffdd43465d95fe6), UINT64_C(0xfffe929a538ad2fa),
+    UINT64_C(0xffff10b1c2119732), UINT64_C(0xffff63df8795a2c9),
+    UINT64_C(0xffff9a87a0a9f2af), UINT64_C(0xffffbe4df6f0f4a9),
+    UINT64_C(0xffffd5a10f204910), UINT64_C(0xffffe4c6f1668b32),
+    UINT64_C(0xffffee939680bfaf), UINT64_C(0xfffff4e4216290db),
+    UINT64_C(0xfffff8f1c044613e), UINT64_C(0xfffffb892dc2b174),
+    UINT64_C(0xfffffd2fb4188608), UINT64_C(0xfffffe3bc0a56eba),
+    UINT64_C(0xfffffee523b218c6), UINT64_C(0xffffff4fc31097e3),
+    UINT64_C(0xffffff929d76dbeb), UINT64_C(0xffffffbc5e7c0350),
+    UINT64_C(0xffffffd6586c6684), UINT64_C(0xffffffe6716865f7),
+    UINT64_C(0xfffffff0613c76e2), UINT64_C(0xfffffff67d62ab64),
+    UINT64_C(0xfffffffa3b6664c0), UINT64_C(0xfffffffc83e13d66),
+    UINT64_C(0xfffffffde713ef71), UINT64_C(0xfffffffebe18936f),
+    UINT64_C(0xffffffff3fbfc997), UINT64_C(0xffffffff8d9fa29a),
+    UINT64_C(0xffffffffbc372590), UINT64_C(0xffffffffd7fb7dfd),
+    UINT64_C(0xffffffffe87747f9), UINT64_C(0xfffffffff2368b89),
+    UINT64_C(0xfffffffff7f44d88), UINT64_C(0xfffffffffb52a49b),
+    UINT64_C(0xfffffffffd4a9ffb), UINT64_C(0xfffffffffe700579),
+    UINT64_C(0xffffffffff1a287f), UINT64_C(0xffffffffff7c6f06),
+    UINT64_C(0xffffffffffb4fa99), UINT64_C(0xffffffffffd56300),
+    UINT64_C(0xffffffffffe7e364), UINT64_C(0xfffffffffff268d7),
+    UINT64_C(0xfffffffffff85e8e), UINT64_C(0xfffffffffffbbb6f),
+    UINT64_C(0xfffffffffffd9f49), UINT64_C(0xfffffffffffeae2c),
+    UINT64_C(0xffffffffffff453d), UINT64_C(0xffffffffffff9928),
+    UINT64_C(0xffffffffffffc797), UINT64_C(0xffffffffffffe12f),
+    UINT64_C(0xffffffffffffef3c), UINT64_C(0xfffffffffffff6eb),
+    UINT64_C(0xfffffffffffffb1b), UINT64_C(0xfffffffffffffd60),
+    UINT64_C(0xfffffffffffffe9a), UINT64_C(0xffffffffffffff43),
+    UINT64_C(0xffffffffffffff9e), UINT64_C(0xffffffffffffffce),
+    UINT64_C(0xffffffffffffffe7), UINT64_C(0xfffffffffffffff4),
+    UINT64_C(0xfffffffffffffffb), UINT64_C(0xfffffffffffffffe),
+};
 
 /*************************************************
- * Name:        sample_gauss16
+ * Name:        sample_gauss83
  *
- * Description: sample gauss using 16 bits integer
+ * Description: sample gauss using 83 bits integer (CDT with 83-bit precision)
  *
- * Arguments:   - const uint64_t rand16: input 16 bits integer
+ * Arguments:   - const uint64_t rand_lo: lower 64 bits of 83-bit random input
+ *              - const uint32_t rand_hi: upper 19 bits of 83-bit random input
  *
- * Specification: Implements Algorithm 15, SampleGauss16.
+ * Returns:     non-negative integer x sampled from D_{Z,16} half-distribution
+ *
+ * Specification: Implements @[Algorithm 17, SampleGauss83]
  **************************************************/
-static uint64_t sample_gauss16(const uint64_t rand16) {
+static uint64_t sample_gauss83(const uint64_t rand_lo, const uint32_t rand_hi) {
   unsigned int i;
   uint64_t r = 0;
-  for (i = 0; i < CDTLEN; i++) {
-    r += (((uint64_t)CDT[i] - rand16) >> 63) & 1;
+
+  for (i = 0; i < CDTHILEN; i++) {
+#ifdef __SIZEOF_INT128__
+    uint128 cdt = ((uint128)CDT83_HI[i] << 64) | CDT83_LO[i];
+    uint128 rnd = ((uint128)rand_hi << 64) | rand_lo;
+    r += (uint64_t)((cdt - rnd) >> 127);
+#else
+    uint64_t borrow = (rand_lo > CDT83_LO[i]);
+    uint64_t hi_diff = (uint64_t)CDT83_HI[i] - rand_hi - borrow;
+    r += hi_diff >> 63;
+#endif
   }
+
+#ifdef __SIZEOF_INT128__
+  uint128 rnd = ((uint128)rand_hi << 64) | rand_lo;
+  for (i = CDTHILEN; i < CDTLEN; i++) {
+    uint128 cdt = ((uint128)UINT64_C(0x7ffff) << 64) | CDT83_LO[i];
+    r += (uint64_t)((cdt - rnd) >> 127);
+  }
+#else
+  for (i = CDTHILEN; i < CDTLEN; i++) {
+    uint64_t borrow = (rand_lo > CDT83_LO[i]);
+    uint64_t hi_diff = (uint64_t)UINT64_C(0x7ffff) - rand_hi - borrow;
+    r += hi_diff >> 63;
+  }
+#endif
+
   return r;
 }
 
@@ -168,41 +339,54 @@ static uint64_t sample_gauss16(const uint64_t rand16) {
  *              - fp96_76 *sqr: pointer to output fixed point
  *              - const uint8_t rand[]: pointer to input integer
  *
- * Specification: Implements Algorithm 14, SampleGaussSigma76.
+ * Specification: Implements @[Algorithm 16, SampleGaussSigma76]
  **************************************************/
-#define GAUSS_RAND (72 + 16 + 48)
-#define GAUSS_RAND_BYTES ((GAUSS_RAND + 7) / 8) // 17
+#define GAUSS_RAND (72 + 83 + 48)
+#define GAUSS_RAND_BYTES ((GAUSS_RAND + 7) / 8) // 26
 static int sample_gauss_sigma76(uint64_t *r, fp96_76 *sqr,
                                 const uint8_t rand[GAUSS_RAND_BYTES]) {
-  const uint64_t rand_gauss16 = rand[0] | (((uint64_t)rand[1]) << 8);
+  // rand[0..10]:  83-bit CDT random (rand_gauss83)
+  // rand[11..16]: 48-bit rejection random (rand_rej)
+  // rand[17..25]: 72-bit y noise
+  const uint64_t rand_gauss83_lo =
+      rand[0] | (((uint64_t)rand[1]) << 8) | (((uint64_t)rand[2]) << 16) |
+      (((uint64_t)rand[3]) << 24) | (((uint64_t)rand[4]) << 32) |
+      (((uint64_t)rand[5]) << 40) | (((uint64_t)rand[6]) << 48) |
+      (((uint64_t)rand[7]) << 56);
+  const uint32_t rand_gauss83_hi =
+      (rand[8] | (((uint32_t)rand[9]) << 8) | (((uint32_t)rand[10]) << 16)) &
+      UINT32_C(0x7FFFF); // mask to 19 bits
   const uint64_t rand_rej =
-      rand[2] | (((uint64_t)rand[3]) << 8) | (((uint64_t)rand[4]) << 16) |
-      (((uint64_t)rand[5]) << 24) | (((uint64_t)rand[6]) << 32) |
-      (((uint64_t)rand[7]) << 40);
+      rand[11] | (((uint64_t)rand[12]) << 8) | (((uint64_t)rand[13]) << 16) |
+      (((uint64_t)rand[14]) << 24) | (((uint64_t)rand[15]) << 32) |
+      (((uint64_t)rand[16]) << 40);
   uint64_t x, exp_in;
   fp96_76 y;
 
   // sample x
-  x = sample_gauss16(rand_gauss16);
+  x = sample_gauss83(rand_gauss83_lo, rand_gauss83_hi);
 
   // y := append x to y
   // leave 16 bit for carries
-  y.limb48[0] = rand[8] | ((uint64_t)rand[9] << 8) |
-                ((uint64_t)rand[10] << 16) | ((uint64_t)rand[11] << 24) |
-                ((uint64_t)rand[12] << 32) | ((uint64_t)rand[13] << 40);
-  y.limb48[1] = rand[14] | ((uint64_t)rand[15] << 8) |
-                ((uint64_t)rand[16] << 16) | (x << 24);
+  y.limb48[0] = rand[17] | ((uint64_t)rand[18] << 8) |
+                ((uint64_t)rand[19] << 16) | ((uint64_t)rand[20] << 24) |
+                ((uint64_t)rand[21] << 32) | ((uint64_t)rand[22] << 40);
+  y.limb48[1] = rand[23] | ((uint64_t)rand[24] << 8) |
+                ((uint64_t)rand[25] << 16) | (x << 24);
 
   // r := round y
-  *r = (y.limb48[0] >> 15) ^ (y.limb48[1] << 33);
-  *r += 1; // rounding
-  *r >>= 1;
+  // y.limb48[1] can be up to 166*2^24 < 2^32 (for x <= 165), so << 33 would
+  // overflow uint64_t for x >= 128.  Split: lower bits round separately, then
+  // add upper bits via << 32 (safe since y.limb48[1] * 2^32 <= 166*2^56 <
+  // 2^64).
+  *r = ((y.limb48[0] >> 15) + 1) >> 1;
+  *r += y.limb48[1] << 32;
 
   // sqr := y*y
   fixpoint_square(sqr, &y);
 
   // sqr[1] = y^2 >> (76+48)                // 34 bit
-  // sqr[0] = (y^2 >> 76) & ((1UL<<48)-1)   // 48 bit
+  // sqr[0] = (y^2 >> 76) & ((UINT64_C(1)<<48)-1)   // 48 bit
   // exp_in := sqr - ((x*x) << 68)
   exp_in = sqr->limb48[1] - ((x * x) << (68 - 48));
   exp_in <<= 20;
@@ -231,7 +415,7 @@ static int sample_gauss_sigma76(uint64_t *r, fp96_76 *sqr,
  *              - size_t len: max length of samples
  *              - int dont_write_last: flag
  *
- * Specification: Implements Algorithm 13, SampleGauss.
+ * Specification: Implements @[Algorithm 15, SampleGauss]
  **************************************************/
 int sample_gauss(uint64_t *r, fp96_76 *sqsum, const uint8_t *buf, size_t buflen,
                  size_t len, int dont_write_last) {
@@ -276,7 +460,7 @@ int sample_gauss(uint64_t *r, fp96_76 *sqsum, const uint8_t *buf, size_t buflen,
  *              - uint16_t nonce: input nonce
  *              - size_t len: number of samples
  *
- * Specification: Implements Algorithm 12, SampleGaussN.
+ * Specification: Implements @[Algorithm 14, SampleGaussN]
  **************************************************/
 #define POLY_HYPERBALL_BUFLEN (GAUSS_RAND_BYTES * HAETAE_N)
 #define POLY_HYPERBALL_NBLOCKS                                                 \

data/vendor/HAETAE/src/sign.c

@@ -1,4 +1,3 @@
-/* kpqc-py: propagate OS entropy failures (2026-09-06). */
 // SPDX-License-Identifier: MIT
 
 #include "api.h"
@@ -29,7 +28,7 @@
  *
  * Returns 0 (success)
  *
- * Specification: Implements Algorithm 48, KeyGenInternal.
+ * Specification: Implements @[Algorithm 54, KeyGenInternal]
  **************************************************/
 
 int crypto_sign_keypair_internal(uint8_t *vk, uint8_t *sk,
@@ -135,13 +134,14 @@ reject:
  *
  * Returns 0 (success)
  *
- * Specification: Implements Algorithm 45, KeyGen.
+ * Specification: Implements @[Algorithm 51, KeyGen]
  **************************************************/
 int crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
   int ret = 0;
   uint8_t seed[HAETAE_SEEDBYTES] = {0};
 
-  if (randombytes(seed, HAETAE_SEEDBYTES) != 0) return -1;
+  if (randombytes(seed, HAETAE_SEEDBYTES) != 0)
+    return -1;
 
   ret = crypto_sign_keypair_internal(pk, sk, seed);
 
@@ -165,7 +165,7 @@ int crypto_sign_keypair(uint8_t *pk, uint8_t *sk) {
  *
  * Returns 0 (success)
  *
- * Specification: Implements Algorithm 49, SignInternal.
+ * Specification: Implements @[Algorithm 55, SignInternal]
  **************************************************/
 int crypto_sign_signature_internal(uint8_t *sig, size_t *siglen,
                                    const uint8_t *m, size_t mlen,
@@ -302,7 +302,7 @@ reject:
   polyveck_caddDQ2ALPHA(&h);
 
   /*------------------ Decompose(z1) and Pack signature -------------------*/
-  polyvecl_lowbits(&lb_z1, &z1rnd);
+  polyvecl_lowbits(&lb_z1, &z1rnd); // TODO do this in one function together!
   polyvecl_highbits(&hb_z1, &z1rnd);
 
   if (pack_sig(sig, &c, &lb_z1, &hb_z1,
@@ -330,7 +330,7 @@ reject:
  *
  * Returns 0 (success)
  *
- * Specification: Implements Algorithm 46, Sign.
+ * Specification: Implements @[Algorithm 52, Sign]
  **************************************************/
 int crypto_sign_signature(uint8_t *sig, size_t *siglen, const uint8_t *m,
                           size_t mlen, const uint8_t *ctx, size_t ctxlen,
@@ -345,7 +345,8 @@ int crypto_sign_signature(uint8_t *sig, size_t *siglen, const uint8_t *m,
   pre[0] = ctxlen;
   memcpy(pre + 1, ctx, ctxlen);
 
-  if (randombytes(rnd, HAETAE_SEEDBYTES) != 0) return -1;
+  if (randombytes(rnd, HAETAE_SEEDBYTES) != 0)
+    return -1;
 
   return crypto_sign_signature_internal(sig, siglen, m, mlen, pre, 1 + ctxlen,
                                         rnd, sk);
@@ -396,7 +397,7 @@ int crypto_sign(uint8_t *sm, size_t *smlen, const uint8_t *m, size_t mlen,
  *
  * Returns 0 if signature could be verified correctly and -1 otherwise
  *
- * Specification: Implements Algorithm 50, VerifyInternal.
+ * Specification: Implements @[Algorithm 56, VerifyInternal]
  **************************************************/
 int crypto_sign_verify_internal(const uint8_t *sig, size_t siglen,
                                 const uint8_t *m, size_t mlen,
@@ -500,7 +501,7 @@ int crypto_sign_verify_internal(const uint8_t *sig, size_t siglen,
  *
  * Returns 0 if signature could be verified correctly and -1 otherwise
  *
- * Specification: Implements Algorithm 47, Verify.
+ * Specification: Implements @[Algorithm 53, Verify]
  **************************************************/
 int crypto_sign_verify(const uint8_t *sig, size_t siglen, const uint8_t *m,
                        size_t mlen, const uint8_t *ctx, size_t ctxlen,

data/vendor/NTRUplus/NTRU+1152/api.h

@@ -3,6 +3,25 @@
 
 #include "params.h"
 
+#ifndef NTRUPLUS_ABI_H
+#define NTRUPLUS_ABI_H
+
+#if defined(_MSC_VER)
+#define NTRUPLUS_INTERNAL
+#define NTRUPLUS_EXTERNAL
+#define NTRUPLUS_SYSV
+#elif defined(__MINGW32__) || defined(__MINGW64__)
+#define NTRUPLUS_INTERNAL
+#define NTRUPLUS_EXTERNAL __declspec(dllexport)
+#define NTRUPLUS_SYSV __attribute__((sysv_abi))
+#else
+#define NTRUPLUS_INTERNAL __attribute__((visibility("hidden")))
+#define NTRUPLUS_EXTERNAL __attribute__((visibility("default")))
+#define NTRUPLUS_SYSV
+#endif
+
+#endif
+
 #define CRYPTO_SECRETKEYBYTES  NTRUPLUS_SECRETKEYBYTES
 #define CRYPTO_PUBLICKEYBYTES  NTRUPLUS_PUBLICKEYBYTES
 #define CRYPTO_CIPHERTEXTBYTES NTRUPLUS_CIPHERTEXTBYTES
@@ -10,15 +29,15 @@
 
 #define CRYPTO_ALGNAME NTRUPLUS_ALGNAME
 
-int crypto_kem_keypair(unsigned char *pk,
-                       unsigned char *sk);
+NTRUPLUS_EXTERNAL int crypto_kem_keypair(unsigned char *pk,
+                                         unsigned char *sk);
 
-int crypto_kem_enc(unsigned char *ct,
-                   unsigned char *ss,
-                   const unsigned char *pk);
+NTRUPLUS_EXTERNAL int crypto_kem_enc(unsigned char *ct,
+                                     unsigned char *ss,
+                                     const unsigned char *pk);
 
-int crypto_kem_dec(unsigned char *ss,
-                   const unsigned char *ct,
-                   const unsigned char *sk);
+NTRUPLUS_EXTERNAL int crypto_kem_dec(unsigned char *ss,
+                                     const unsigned char *ct,
+                                     const unsigned char *sk);
 
 #endif