kpqc 0.1.0 → 0.2.0

data/vendor/NTRUplus/NTRU+768/kem.c

@@ -1,4 +1,4 @@
-/* kpqc-py: propagate OS entropy failures (2026-09-06). */
+#include "util.h"
 #include <stddef.h>
 #include <stdint.h>
 #include "api.h"
@@ -8,6 +8,13 @@
 #include "fips202/fips202.h"
 #include "randombytes.h"
 
+#ifdef NTRUPLUS_SUPERCOP
+#include "crypto_declassify.h"
+#define ntruplus_declassify crypto_declassify
+#else
+#define ntruplus_declassify(x, xlen) ((void)(x), (void)(xlen))
+#endif
+
 /*************************************************
 * Name:        verify
 *
@@ -38,18 +45,19 @@ static inline int verify(const uint8_t *a, const uint8_t *b, size_t len)
 * Arguments:   - poly *f:     output polynomial f (NTT domain)
 *              - poly *finv:  output multiplicative inverse of f
 *                              in the NTT domain
+*              - uint8_t *buf: workspace of NTRUPLUS_N/4 bytes
 *              - const uint8_t *coins: 32-byte deterministic seed
 *
 * Returns 0 on success; non-zero if f is not invertible in the NTT domain.
 **************************************************/
-static inline int genf_derand(poly *f, poly *finv, const uint8_t *coins)
+static inline int genf_derand(poly *f, poly *finv,
+                              uint8_t buf[NTRUPLUS_N / 4],
+                              const uint8_t *coins)
 {
-    uint8_t buf[NTRUPLUS_N / 4];
-
-    shake256(buf, sizeof buf, coins, 32);
+    shake256(buf, NTRUPLUS_N / 4, coins, 32);
 
     poly_cbd1(f, buf);
-    poly_triple(f, f);
+    poly_triple(f);
     f->coeffs[0] += 1;
 
     poly_ntt(f);
@@ -66,18 +74,19 @@ static inline int genf_derand(poly *f, poly *finv, const uint8_t *coins)
 * Arguments:   - poly *g:      output polynomial g (NTT domain)
 *              - poly *ginv:   output multiplicative inverse of g
 *                               in the NTT domain
+*              - uint8_t *buf: workspace of NTRUPLUS_N/4 bytes
 *              - const uint8_t *coins: 32-byte deterministic seed
 *
 * Returns 0 on success; non-zero if g is not invertible in the NTT domain.
 **************************************************/
-static inline int geng_derand(poly *g, poly *ginv, const uint8_t *coins)
+static inline int geng_derand(poly *g, poly *ginv,
+                              uint8_t buf[NTRUPLUS_N / 4],
+                              const uint8_t *coins)
 {
-    uint8_t buf[NTRUPLUS_N / 4];
-
-    shake256(buf, sizeof buf, coins, 32);
+    shake256(buf, NTRUPLUS_N / 4, coins, 32);
 
     poly_cbd1(g, buf);
-    poly_triple(g, g);
+    poly_triple(g);
 
     poly_ntt(g);
 
@@ -113,6 +122,9 @@ static inline void crypto_kem_keypair_derand(uint8_t *pk, uint8_t *sk,
     poly_tobytes(sk, f);
     poly_tobytes(sk + NTRUPLUS_POLYBYTES, &hinv);
     hash_f(sk + 2 * NTRUPLUS_POLYBYTES, pk);
+
+    secure_clear(&h, sizeof h);
+    secure_clear(&hinv, sizeof hinv);
 }
 
 /*************************************************
@@ -130,23 +142,39 @@ static inline void crypto_kem_keypair_derand(uint8_t *pk, uint8_t *sk,
 *
 * Returns 0 on success.
 **************************************************/
-int crypto_kem_keypair(uint8_t *pk, uint8_t *sk)
+int crypto_kem_keypair(unsigned char *pk, unsigned char *sk)
 {
     uint8_t coins[NTRUPLUS_SYMBYTES];
+    uint8_t buf[NTRUPLUS_N / 4];
+    int r;
+    int status = -1;
 
     poly f, finv;
     poly g, ginv;
 
     do {
-        if (randombytes(coins, sizeof coins) != 0) return -1;
-    } while (genf_derand(&f, &finv, coins));
+        if (randombytes(coins, sizeof coins) != 0) goto cleanup;
+        r = genf_derand(&f, &finv, buf, coins);
+        ntruplus_declassify(&r, sizeof r);
+    } while (r);
 
     do {
-        if (randombytes(coins, sizeof coins) != 0) return -1;
-    } while (geng_derand(&g, &ginv, coins));
+        if (randombytes(coins, sizeof coins) != 0) goto cleanup;
+        r = geng_derand(&g, &ginv, buf, coins);
+        ntruplus_declassify(&r, sizeof r);
+    } while (r);
 
     crypto_kem_keypair_derand(pk, sk, &f, &finv, &g, &ginv);
-    return 0;
+    status = 0;
+
+cleanup:
+    secure_clear(coins, sizeof coins);
+    secure_clear(buf, sizeof buf);
+    secure_clear(&f, sizeof f);
+    secure_clear(&finv, sizeof finv);
+    secure_clear(&g, sizeof g);
+    secure_clear(&ginv, sizeof ginv);
+    return status;
 }
 
 /*************************************************
@@ -162,17 +190,27 @@ int crypto_kem_keypair(uint8_t *pk, uint8_t *sk)
 *              - const uint8_t *coins: input randomness for
 *                                      deterministic encapsulation
 *
-* Returns 0 on success.
+* Returns 0 on success. If pk contains a non-canonical coefficient, ct and ss
+* are set to all zero bytes and 1 is returned.
 **************************************************/
 static inline int crypto_kem_enc_derand(uint8_t *ct, uint8_t *ss,
                                         const uint8_t *pk,
                                         const uint8_t *coins)
 {
-	uint8_t msg[NTRUPLUS_N / 8 + NTRUPLUS_SYMBYTES];
-	uint8_t buf1[NTRUPLUS_SYMBYTES + NTRUPLUS_N / 4];
-	uint8_t buf2[NTRUPLUS_POLYBYTES];
+	uint8_t msg[HASH_H_INBYTES];
+	uint8_t buf1[HASH_H_OUTBYTES];
+	uint8_t buf2[HASH_G_INBYTES];
     
     poly c, h, r, m;
+
+    if(poly_frombytes(&h, pk))
+    {
+        for (size_t i = 0; i < NTRUPLUS_CIPHERTEXTBYTES; i++)
+            ct[i] = 0;
+        secure_clear(ss, NTRUPLUS_SSBYTES);
+
+        return 1;
+    }
     
     for (size_t i = 0; i < NTRUPLUS_N / 8; i++)
         msg[i] = coins[i];
@@ -188,12 +226,17 @@ static inline int crypto_kem_enc_derand(uint8_t *ct, uint8_t *ss,
     poly_sotp_encode(&m, msg, buf2);
     poly_ntt(&m);
     
-    poly_frombytes(&h, pk);
     poly_basemul_add(&c, &h, &r, &m);
     poly_tobytes(ct, &c);
     
     for (size_t i = 0; i < NTRUPLUS_SSBYTES; i++)
         ss[i] = buf1[i];
+
+    secure_clear(msg, sizeof msg);
+    secure_clear(buf1, sizeof buf1);
+    secure_clear(buf2, sizeof buf2);
+    secure_clear(&r, sizeof r);
+    secure_clear(&m, sizeof m);
     
     return 0;
 }
@@ -212,14 +255,22 @@ static inline int crypto_kem_enc_derand(uint8_t *ct, uint8_t *ss,
 *              - const uint8_t *pk: input public key
 *                (array of CRYPTO_PUBLICKEYBYTES bytes)
 *
-* Returns 0 on success.
+* Returns 0 on success. If pk contains a non-canonical coefficient, ct and ss
+* are set to all zero bytes and 1 is returned.
 **************************************************/
-int crypto_kem_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk)
+int crypto_kem_enc(unsigned char *ct, unsigned char *ss,
+                   const unsigned char *pk)
 {
     uint8_t coins[NTRUPLUS_N / 8];
+    int ret;
 
-    if (randombytes(coins, sizeof coins) != 0) return -1;
-    return crypto_kem_enc_derand(ct, ss, pk, coins);
+    if (randombytes(coins, sizeof coins) != 0) {
+        secure_clear(coins, sizeof coins);
+        return -1;
+    }
+    ret = crypto_kem_enc_derand(ct, ss, pk, coins);
+    secure_clear(coins, sizeof coins);
+    return ret;
 }
 
 /*************************************************
@@ -238,26 +289,32 @@ int crypto_kem_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk)
 *
 * Returns 0 on success, 1 on failure.
 **************************************************/
-int crypto_kem_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk)
+int crypto_kem_dec(unsigned char *ss, const unsigned char *ct,
+                   const unsigned char *sk)
 {
-	uint8_t msg[NTRUPLUS_N / 8 + NTRUPLUS_SYMBYTES];
-	uint8_t buf1[NTRUPLUS_POLYBYTES];
-	uint8_t buf2[NTRUPLUS_POLYBYTES];
-	uint8_t buf3[NTRUPLUS_POLYBYTES + NTRUPLUS_SYMBYTES];
-    
-    int8_t fail;
+	uint8_t msg[HASH_H_INBYTES];
+	uint8_t buf1[HASH_G_INBYTES];
+	uint8_t buf2[HASH_G_INBYTES];
+	uint8_t buf3[HASH_H_OUTBYTES];
+
+    int8_t fail = 1;
     
     poly c, f, hinv;
     poly r1, r2;
     poly m1, m2;
-    
-    poly_frombytes(&c, ct);
-    poly_frombytes(&f, sk);
-    poly_frombytes(&hinv, sk + NTRUPLUS_POLYBYTES);
+
+    if(poly_frombytes(&c, ct) ||
+       poly_frombytes(&f, sk) ||
+       poly_frombytes(&hinv, sk + NTRUPLUS_POLYBYTES))
+    {
+        secure_clear(ss, NTRUPLUS_SSBYTES);
+
+        goto cleanup;
+    }
     
     poly_basemul(&m1, &c, &f);
     poly_invntt(&m1);
-    poly_crepmod3(&m1, &m1);
+    poly_crepmod3(&m1);
     
     m2 = m1;
     poly_ntt(&m2);
@@ -268,7 +325,7 @@ int crypto_kem_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk)
     hash_g(buf2, buf1);
     fail = poly_sotp_decode(msg, &m1, buf2);
     
-    for (size_t i = 0; i < NTRUPLUS_SYMBYTES; i++)
+    for (size_t i = 0; i < HASH_F_OUTBYTES; i++)
         msg[i + NTRUPLUS_N / 8] = sk[i + 2 * NTRUPLUS_POLYBYTES];
     
     hash_h(buf3, msg);
@@ -281,6 +338,19 @@ int crypto_kem_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk)
     
     for (size_t i = 0; i < NTRUPLUS_SSBYTES; i++)
         ss[i] = buf3[i] & ~(-fail);
-    
+
+cleanup:
+    secure_clear(msg, sizeof msg);
+    secure_clear(buf1, sizeof buf1);
+    secure_clear(buf2, sizeof buf2);
+    secure_clear(buf3, sizeof buf3);
+    secure_clear(&c, sizeof c);
+    secure_clear(&f, sizeof f);
+    secure_clear(&hinv, sizeof hinv);
+    secure_clear(&r1, sizeof r1);
+    secure_clear(&r2, sizeof r2);
+    secure_clear(&m1, sizeof m1);
+    secure_clear(&m2, sizeof m2);
+
     return fail;
 }

data/vendor/NTRUplus/NTRU+768/ntt.c

@@ -104,8 +104,9 @@ static inline int16_t fqmul(int16_t a, int16_t b)
 /*************************************************
 * Name:        fqinv
 *
-* Description: Computes the multiplicative inverse of a value in the
-*              finite field Z_q.
+* Description: Computes the multiplicative inverse in Z_q using Fermat's
+*              little theorem. The exponent q-2 = 3455 is evaluated using
+*              a shortest addition chain of length 15 (OEIS A003313).
 *
 * Arguments:   - int16_t a: input value a mod q
 *
@@ -113,32 +114,27 @@ static inline int16_t fqmul(int16_t a, int16_t b)
 **************************************************/
 static inline int16_t fqinv(int16_t a)
 {
-	int16_t t1, t2, t3;
-
-	t1 = fqmul(a, a);    // 10
-	t2 = fqmul(t1, t1);  // 100
-	t2 = fqmul(t2, t2);  // 1000
-	t3 = fqmul(t2, t2);  // 10000
-
-	t1 = fqmul(t1, t2);  // 1010
-
-	t2 = fqmul(t1, t3);  // 11010
-	t2 = fqmul(t2, t2);  // 110100
-	t2 = fqmul(t2, a);   // 110101
-
-	t1 = fqmul(t1, t2);  // 111111
-
-	t2 = fqmul(t2, t2);  // 1101010
-	t2 = fqmul(t2, t2);  // 11010100
-	t2 = fqmul(t2, t2);  // 110101000
-	t2 = fqmul(t2, t2);  // 1101010000
-	t2 = fqmul(t2, t2);  // 11010100000
-	t2 = fqmul(t2, t2);  // 110101000000
-	t2 = fqmul(t2, t1);  // 110101111111
-
-	t2 = fqmul(NTRUPLUS_RINV, t2);
-
-	return t2;
+	int16_t t0, t1;
+
+	t0 = fqmul(a, a);    // 10
+	t0 = fqmul(t0, t0);  // 100
+	t0 = fqmul(t0, t0);  // 1000
+	t0 = fqmul(t0, t0);  // 10000
+	t1 = fqmul(t0, a);   // 10001
+
+	t0 = fqmul(t0, t0);  // 100000
+	t0 = fqmul(t0, t0);  // 1000000
+	t0 = fqmul(t0, t0);  // 10000000
+	t1 = fqmul(t0, t1);  // 10010001
+
+	t0 = fqmul(t1, t0);  // 100010001
+	t1 = fqmul(t0, t1);  // 110100010
+	t1 = fqmul(t1, t0);  // 1010110011
+	t0 = fqmul(t1, t1);  // 10101100110
+	t0 = fqmul(t0, t0);  // 101011001100
+	t0 = fqmul(t0, t1);  // 110101111111
+
+	return fqmul(NTRUPLUS_RINV, t0);
 }
 
 /*************************************************
@@ -331,19 +327,19 @@ int baseinv(int16_t r[4], const int16_t a[4], const int16_t zeta)
 **************************************************/
 void basemul(int16_t r[4], const int16_t a[4], const int16_t b[4], const int16_t zeta)
 {
-	r[0] = montgomery_reduce(a[1]*b[3]+a[2]*b[2]+a[3]*b[1]); // R^-1
-	r[1] = montgomery_reduce(a[2]*b[3]+a[3]*b[2]);           // R^-1
-	r[2] = montgomery_reduce(a[3]*b[3]);                     // R^-1
-
-	r[0] = montgomery_reduce(r[0]*zeta+a[0]*b[0]);  				   // R^-1
-	r[1] = montgomery_reduce(r[1]*zeta+a[0]*b[1]+a[1]*b[0]); 		   // R^-1
-	r[2] = montgomery_reduce(r[2]*zeta+a[0]*b[2]+a[1]*b[1]+a[2]*b[0]); // R^-1
-	r[3] = montgomery_reduce(a[0]*b[3]+a[1]*b[2]+a[2]*b[1]+a[3]*b[0]); // R^-1
-
-	r[0] = montgomery_reduce(r[0]*NTRUPLUS_RSQ); // R^0
-	r[1] = montgomery_reduce(r[1]*NTRUPLUS_RSQ); // R^0
-	r[2] = montgomery_reduce(r[2]*NTRUPLUS_RSQ); // R^0
-	r[3] = montgomery_reduce(r[3]*NTRUPLUS_RSQ); // R^0
+	int16_t t0 = montgomery_reduce(a[1]*b[3]+a[2]*b[2]+a[3]*b[1]); // R^-1
+	int16_t t1 = montgomery_reduce(a[2]*b[3]+a[3]*b[2]);           // R^-1
+	int16_t t2 = montgomery_reduce(a[3]*b[3]);                     // R^-1
+
+	int16_t c0 = montgomery_reduce(t0*zeta+a[0]*b[0]);                       // R^-1
+	int16_t c1 = montgomery_reduce(t1*zeta+a[0]*b[1]+a[1]*b[0]);             // R^-1
+	int16_t c2 = montgomery_reduce(t2*zeta+a[0]*b[2]+a[1]*b[1]+a[2]*b[0]);   // R^-1
+	int16_t c3 = montgomery_reduce(a[0]*b[3]+a[1]*b[2]+a[2]*b[1]+a[3]*b[0]); // R^-1
+
+	r[0] = montgomery_reduce(c0*NTRUPLUS_RSQ); // R^0
+	r[1] = montgomery_reduce(c1*NTRUPLUS_RSQ); // R^0
+	r[2] = montgomery_reduce(c2*NTRUPLUS_RSQ); // R^0
+	r[3] = montgomery_reduce(c3*NTRUPLUS_RSQ); // R^0
 }
 
 /*************************************************
@@ -363,17 +359,17 @@ void basemul(int16_t r[4], const int16_t a[4], const int16_t b[4], const int16_t
 **************************************************/
 void basemul_add(int16_t r[4], const int16_t a[4], const int16_t b[4], const int16_t c[4], const int16_t zeta)
 {
-	r[0] = montgomery_reduce(a[1]*b[3]+a[2]*b[2]+a[3]*b[1]); // R^-1
-	r[1] = montgomery_reduce(a[2]*b[3]+a[3]*b[2]);           // R^-1
-	r[2] = montgomery_reduce(a[3]*b[3]);                     // R^-1
-
-	r[0] = montgomery_reduce(r[0]*zeta+a[0]*b[0]);  				   // R^-1
-	r[1] = montgomery_reduce(r[1]*zeta+a[0]*b[1]+a[1]*b[0]); 		   // R^-1
-	r[2] = montgomery_reduce(r[2]*zeta+a[0]*b[2]+a[1]*b[1]+a[2]*b[0]); // R^-1
-	r[3] = montgomery_reduce(a[0]*b[3]+a[1]*b[2]+a[2]*b[1]+a[3]*b[0]); // R^-1
-
-	r[0] = montgomery_reduce(c[0]*NTRUPLUS_R + r[0]*NTRUPLUS_RSQ); // R^0
-	r[1] = montgomery_reduce(c[1]*NTRUPLUS_R + r[1]*NTRUPLUS_RSQ); // R^0
-	r[2] = montgomery_reduce(c[2]*NTRUPLUS_R + r[2]*NTRUPLUS_RSQ); // R^0
-	r[3] = montgomery_reduce(c[3]*NTRUPLUS_R + r[3]*NTRUPLUS_RSQ); // R^0
+	int16_t t0 = montgomery_reduce(a[1]*b[3]+a[2]*b[2]+a[3]*b[1]); // R^-1
+	int16_t t1 = montgomery_reduce(a[2]*b[3]+a[3]*b[2]);           // R^-1
+	int16_t t2 = montgomery_reduce(a[3]*b[3]);                     // R^-1
+
+	int16_t c0 = montgomery_reduce(t0*zeta+a[0]*b[0]);                       // R^-1
+	int16_t c1 = montgomery_reduce(t1*zeta+a[0]*b[1]+a[1]*b[0]);             // R^-1
+	int16_t c2 = montgomery_reduce(t2*zeta+a[0]*b[2]+a[1]*b[1]+a[2]*b[0]);   // R^-1
+	int16_t c3 = montgomery_reduce(a[0]*b[3]+a[1]*b[2]+a[2]*b[1]+a[3]*b[0]); // R^-1
+
+	r[0] = montgomery_reduce(c[0]*NTRUPLUS_R + c0*NTRUPLUS_RSQ); // R^0
+	r[1] = montgomery_reduce(c[1]*NTRUPLUS_R + c1*NTRUPLUS_RSQ); // R^0
+	r[2] = montgomery_reduce(c[2]*NTRUPLUS_R + c2*NTRUPLUS_RSQ); // R^0
+	r[3] = montgomery_reduce(c[3]*NTRUPLUS_R + c3*NTRUPLUS_RSQ); // R^0
 }

data/vendor/NTRUplus/NTRU+768/poly.c

@@ -1,3 +1,4 @@
+#include "util.h"
 #include <stdint.h>
 #include <string.h>
 #include "params.h"
@@ -42,7 +43,6 @@ void poly_tobytes(uint8_t r[NTRUPLUS_POLYBYTES], const poly *a)
 {
 	int16_t t[2];
 
-	#pragma GCC unroll 2
 	for(size_t i = 0; i < NTRUPLUS_N/2; i++)
 	{
 		t[0] = a->coeffs[2*i];
@@ -65,14 +65,25 @@ void poly_tobytes(uint8_t r[NTRUPLUS_POLYBYTES], const poly *a)
 * Arguments:   - poly *r:          pointer to output polynomial
 *              - const uint8_t *a: pointer to input byte array
 *                                  (of NTRUPLUS_POLYBYTES bytes)
+*
+* Returns 0 on success, 1 if any coefficient is greater than or equal to q.
 **************************************************/
-void poly_frombytes(poly *r, const uint8_t a[NTRUPLUS_POLYBYTES])
+int poly_frombytes(poly *r, const uint8_t a[NTRUPLUS_POLYBYTES])
 {
+	uint32_t fail = 0;
+
 	for(size_t i = 0; i < NTRUPLUS_N/2; i++)
 	{
-		r->coeffs[2*i]   = ((a[3*i+0] >> 0) | ((uint16_t)a[3*i+1] << 8)) & 0xFFF;
-		r->coeffs[2*i+1] = ((a[3*i+1] >> 4) | ((uint16_t)a[3*i+2] << 4)) & 0xFFF;
+		const uint16_t t0 = ((a[3*i+0] >> 0) | ((uint16_t)a[3*i+1] << 8)) & 0xFFF;
+		const uint16_t t1 = ((a[3*i+1] >> 4) | ((uint16_t)a[3*i+2] << 4)) & 0xFFF;
+
+		r->coeffs[2*i]   = t0;
+		r->coeffs[2*i+1] = t1;
+		fail |= (uint32_t)(NTRUPLUS_Q - 1) - t0;
+		fail |= (uint32_t)(NTRUPLUS_Q - 1) - t1;
 	}
+
+	return fail >> 31;
 }
 
 /*************************************************
@@ -129,6 +140,7 @@ void poly_sotp_encode(poly *r, const uint8_t msg[NTRUPLUS_N/8], const uint8_t bu
     }
 
 	poly_cbd1(r, tmp);
+	secure_clear(tmp, sizeof tmp);
 }
 
 /*************************************************
@@ -147,7 +159,7 @@ int poly_sotp_decode(uint8_t msg[NTRUPLUS_N/8], const poly *a, const uint8_t buf
 	uint8_t t1, t2, t3;
 	uint16_t t4;
 	uint32_t r = 0;
-	uint8_t mask;
+	volatile uint8_t mask;
 
 	for(size_t i = 0; i < NTRUPLUS_N / 8; i++)
 	{
@@ -296,13 +308,12 @@ void poly_sub(poly *r, const poly *a, const poly *b)
 *
 * Description: Multiply polynomial by 3; no modular reduction is performed
 *
-* Arguments: - poly *r: pointer to output polynomial
-*            - const poly *a: pointer to input polynomial
+* Arguments: - poly *r: pointer to input/output polynomial
 **************************************************/
-void poly_triple(poly *r, const poly *a) 
+void poly_triple(poly *r)
 {
 	for(int i = 0; i < NTRUPLUS_N; ++i)
-		r->coeffs[i] = 3*a->coeffs[i];
+		r->coeffs[i] *= 3;
 }
 
 /*************************************************
@@ -310,11 +321,10 @@ void poly_triple(poly *r, const poly *a)
 *
 * Description: Compute modulus 3 operation to polynomial
 *
-* Arguments: - poly *r: pointer to output polynomial
-*            - const poly *a: pointer to input polynomial
+* Arguments: - poly *r: pointer to input/output polynomial
 **************************************************/
-void poly_crepmod3(poly *r, const poly *a)
+void poly_crepmod3(poly *r)
 {
 	for(int i = 0; i < NTRUPLUS_N; i++)
-    	r->coeffs[i] = crepmod3(a->coeffs[i]);
+		r->coeffs[i] = crepmod3(r->coeffs[i]);
 }

data/vendor/NTRUplus/NTRU+768/poly.h

@@ -13,7 +13,7 @@ typedef struct{
 } poly;
 
 void poly_tobytes(uint8_t r[NTRUPLUS_POLYBYTES], const poly *a);
-void poly_frombytes(poly *r, const uint8_t a[NTRUPLUS_POLYBYTES]);
+int  poly_frombytes(poly *r, const uint8_t a[NTRUPLUS_POLYBYTES]);
 
 void poly_cbd1(poly *r, const uint8_t buf[NTRUPLUS_N/4]);
 void poly_sotp_encode(poly *r, const uint8_t msg[NTRUPLUS_N/8], const uint8_t buf[NTRUPLUS_N/4]);
@@ -25,7 +25,7 @@ int  poly_baseinv(poly *r, const poly *a);
 void poly_basemul(poly *r, const poly *a, const poly *b);
 void poly_basemul_add(poly *r, const poly *a, const poly *b, const poly *c);
 void poly_sub(poly *r, const poly *a, const poly *b);
-void poly_triple(poly *r, const poly *a);
-void poly_crepmod3(poly *r, const poly *a);
+void poly_triple(poly *r);
+void poly_crepmod3(poly *r);
 
 #endif

data/vendor/NTRUplus/NTRU+768/randombytes.h

@@ -4,6 +4,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
+/* KpqC bindings propagate failures from the operating-system entropy source. */
 int randombytes(uint8_t *out, size_t outlen);
 
 #endif

data/vendor/NTRUplus/NTRU+768/symmetric.c

@@ -1,16 +1,8 @@
+#include "util.h"
 #include <string.h>
 #include "symmetric.h"
 #include "fips202/fips202.h"
 
-#define HASH_F_INBYTES  (NTRUPLUS_POLYBYTES)
-#define HASH_F_OUTBYTES (32)
-
-#define HASH_G_INBYTES  (NTRUPLUS_POLYBYTES)
-#define HASH_G_OUTBYTES (NTRUPLUS_N / 4)
-
-#define HASH_H_INBYTES  (NTRUPLUS_N / 8 + NTRUPLUS_SYMBYTES)
-#define HASH_H_OUTBYTES (NTRUPLUS_SSBYTES + NTRUPLUS_N / 4)
-
 void hash_f(uint8_t *buf, const uint8_t *msg)
 {
     uint8_t data[1 + HASH_F_INBYTES];
@@ -27,6 +19,7 @@ void hash_g(uint8_t *buf, const uint8_t *msg)
     data[0] = 0x01;
     memcpy(data + 1, msg, HASH_G_INBYTES);
     shake256(buf, HASH_G_OUTBYTES, data, HASH_G_INBYTES + 1);
+    secure_clear(data, sizeof data);
 }
 
 void hash_h(uint8_t *buf, const uint8_t *msg)
@@ -36,4 +29,5 @@ void hash_h(uint8_t *buf, const uint8_t *msg)
     data[0] = 0x02;
     memcpy(data + 1, msg, HASH_H_INBYTES);
     shake256(buf, HASH_H_OUTBYTES, data, HASH_H_INBYTES + 1);
+    secure_clear(data, sizeof data);
 }

data/vendor/NTRUplus/NTRU+768/symmetric.h

@@ -3,10 +3,20 @@
 
 #include <stddef.h>
 #include <stdint.h>
+#include "api.h"
 #include "params.h"
 
-void hash_f(uint8_t *buf, const uint8_t *msg);
-void hash_g(uint8_t *buf, const uint8_t *msg);
-void hash_h(uint8_t *buf, const uint8_t *msg);
+#define HASH_F_INBYTES  (NTRUPLUS_POLYBYTES)
+#define HASH_F_OUTBYTES (NTRUPLUS_SYMBYTES)
+
+#define HASH_G_INBYTES  (NTRUPLUS_POLYBYTES)
+#define HASH_G_OUTBYTES (NTRUPLUS_N / 4)
+
+#define HASH_H_INBYTES  (NTRUPLUS_N / 8 + NTRUPLUS_SYMBYTES)
+#define HASH_H_OUTBYTES (NTRUPLUS_SSBYTES + NTRUPLUS_N / 4)
+
+NTRUPLUS_INTERNAL void hash_f(uint8_t *buf, const uint8_t *msg);
+NTRUPLUS_INTERNAL void hash_g(uint8_t *buf, const uint8_t *msg);
+NTRUPLUS_INTERNAL void hash_h(uint8_t *buf, const uint8_t *msg);
 
 #endif /* SYMMETRIC_H */

data/vendor/NTRUplus/NTRU+768/util.h

@@ -0,0 +1,15 @@
+#ifndef NTRUPLUS_UTIL_H
+#define NTRUPLUS_UTIL_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+static inline void secure_clear(void *v, size_t len)
+{
+    volatile uint8_t *p = v;
+
+    while (len-- > 0)
+        *p++ = 0;
+}
+
+#endif /* NTRUPLUS_UTIL_H */

data/vendor/NTRUplus/NTRU+864/api.h

@@ -3,6 +3,25 @@
 
 #include "params.h"
 
+#ifndef NTRUPLUS_ABI_H
+#define NTRUPLUS_ABI_H
+
+#if defined(_MSC_VER)
+#define NTRUPLUS_INTERNAL
+#define NTRUPLUS_EXTERNAL
+#define NTRUPLUS_SYSV
+#elif defined(__MINGW32__) || defined(__MINGW64__)
+#define NTRUPLUS_INTERNAL
+#define NTRUPLUS_EXTERNAL __declspec(dllexport)
+#define NTRUPLUS_SYSV __attribute__((sysv_abi))
+#else
+#define NTRUPLUS_INTERNAL __attribute__((visibility("hidden")))
+#define NTRUPLUS_EXTERNAL __attribute__((visibility("default")))
+#define NTRUPLUS_SYSV
+#endif
+
+#endif
+
 #define CRYPTO_SECRETKEYBYTES  NTRUPLUS_SECRETKEYBYTES
 #define CRYPTO_PUBLICKEYBYTES  NTRUPLUS_PUBLICKEYBYTES
 #define CRYPTO_CIPHERTEXTBYTES NTRUPLUS_CIPHERTEXTBYTES
@@ -10,15 +29,15 @@
 
 #define CRYPTO_ALGNAME NTRUPLUS_ALGNAME
 
-int crypto_kem_keypair(unsigned char *pk,
-                       unsigned char *sk);
+NTRUPLUS_EXTERNAL int crypto_kem_keypair(unsigned char *pk,
+                                         unsigned char *sk);
 
-int crypto_kem_enc(unsigned char *ct,
-                   unsigned char *ss,
-                   const unsigned char *pk);
+NTRUPLUS_EXTERNAL int crypto_kem_enc(unsigned char *ct,
+                                     unsigned char *ss,
+                                     const unsigned char *pk);
 
-int crypto_kem_dec(unsigned char *ss,
-                   const unsigned char *ct,
-                   const unsigned char *sk);
+NTRUPLUS_EXTERNAL int crypto_kem_dec(unsigned char *ss,
+                                     const unsigned char *ct,
+                                     const unsigned char *sk);
 
 #endif