kpqc 0.1.0 → 0.2.0

data/vendor/NTRUplus/NTRU+864/kem.c

@@ -1,4 +1,4 @@
-/* kpqc-py: propagate OS entropy failures (2026-09-06). */
+#include "util.h"
 #include <stddef.h>
 #include <stdint.h>
 #include "api.h"
@@ -8,6 +8,13 @@
 #include "fips202/fips202.h"
 #include "randombytes.h"
 
+#ifdef NTRUPLUS_SUPERCOP
+#include "crypto_declassify.h"
+#define ntruplus_declassify crypto_declassify
+#else
+#define ntruplus_declassify(x, xlen) ((void)(x), (void)(xlen))
+#endif
+
 /*************************************************
 * Name:        verify
 *
@@ -38,18 +45,19 @@ static inline int verify(const uint8_t *a, const uint8_t *b, size_t len)
 * Arguments:   - poly *f:     output polynomial f (NTT domain)
 *              - poly *finv:  output multiplicative inverse of f
 *                              in the NTT domain
+*              - uint8_t *buf: workspace of NTRUPLUS_N/4 bytes
 *              - const uint8_t *coins: 32-byte deterministic seed
 *
 * Returns 0 on success; non-zero if f is not invertible in the NTT domain.
 **************************************************/
-static inline int genf_derand(poly *f, poly *finv, const uint8_t *coins)
+static inline int genf_derand(poly *f, poly *finv,
+                              uint8_t buf[NTRUPLUS_N / 4],
+                              const uint8_t *coins)
 {
-    uint8_t buf[NTRUPLUS_N / 4];
-
-    shake256(buf, sizeof buf, coins, 32);
+    shake256(buf, NTRUPLUS_N / 4, coins, 32);
 
     poly_cbd1(f, buf);
-    poly_triple(f, f);
+    poly_triple(f);
     f->coeffs[0] += 1;
 
     poly_ntt(f);
@@ -66,18 +74,19 @@ static inline int genf_derand(poly *f, poly *finv, const uint8_t *coins)
 * Arguments:   - poly *g:      output polynomial g (NTT domain)
 *              - poly *ginv:   output multiplicative inverse of g
 *                               in the NTT domain
+*              - uint8_t *buf: workspace of NTRUPLUS_N/4 bytes
 *              - const uint8_t *coins: 32-byte deterministic seed
 *
 * Returns 0 on success; non-zero if g is not invertible in the NTT domain.
 **************************************************/
-static inline int geng_derand(poly *g, poly *ginv, const uint8_t *coins)
+static inline int geng_derand(poly *g, poly *ginv,
+                              uint8_t buf[NTRUPLUS_N / 4],
+                              const uint8_t *coins)
 {
-    uint8_t buf[NTRUPLUS_N / 4];
-
-    shake256(buf, sizeof buf, coins, 32);
+    shake256(buf, NTRUPLUS_N / 4, coins, 32);
 
     poly_cbd1(g, buf);
-    poly_triple(g, g);
+    poly_triple(g);
 
     poly_ntt(g);
 
@@ -113,6 +122,9 @@ static inline void crypto_kem_keypair_derand(uint8_t *pk, uint8_t *sk,
     poly_tobytes(sk, f);
     poly_tobytes(sk + NTRUPLUS_POLYBYTES, &hinv);
     hash_f(sk + 2 * NTRUPLUS_POLYBYTES, pk);
+
+    secure_clear(&h, sizeof h);
+    secure_clear(&hinv, sizeof hinv);
 }
 
 /*************************************************
@@ -130,23 +142,39 @@ static inline void crypto_kem_keypair_derand(uint8_t *pk, uint8_t *sk,
 *
 * Returns 0 on success.
 **************************************************/
-int crypto_kem_keypair(uint8_t *pk, uint8_t *sk)
+int crypto_kem_keypair(unsigned char *pk, unsigned char *sk)
 {
     uint8_t coins[NTRUPLUS_SYMBYTES];
+    uint8_t buf[NTRUPLUS_N / 4];
+    int r;
+    int status = -1;
 
     poly f, finv;
     poly g, ginv;
 
     do {
-        if (randombytes(coins, sizeof coins) != 0) return -1;
-    } while (genf_derand(&f, &finv, coins));
+        if (randombytes(coins, sizeof coins) != 0) goto cleanup;
+        r = genf_derand(&f, &finv, buf, coins);
+        ntruplus_declassify(&r, sizeof r);
+    } while (r);
 
     do {
-        if (randombytes(coins, sizeof coins) != 0) return -1;
-    } while (geng_derand(&g, &ginv, coins));
+        if (randombytes(coins, sizeof coins) != 0) goto cleanup;
+        r = geng_derand(&g, &ginv, buf, coins);
+        ntruplus_declassify(&r, sizeof r);
+    } while (r);
 
     crypto_kem_keypair_derand(pk, sk, &f, &finv, &g, &ginv);
-    return 0;
+    status = 0;
+
+cleanup:
+    secure_clear(coins, sizeof coins);
+    secure_clear(buf, sizeof buf);
+    secure_clear(&f, sizeof f);
+    secure_clear(&finv, sizeof finv);
+    secure_clear(&g, sizeof g);
+    secure_clear(&ginv, sizeof ginv);
+    return status;
 }
 
 /*************************************************
@@ -162,17 +190,27 @@ int crypto_kem_keypair(uint8_t *pk, uint8_t *sk)
 *              - const uint8_t *coins: input randomness for
 *                                      deterministic encapsulation
 *
-* Returns 0 on success.
+* Returns 0 on success. If pk contains a non-canonical coefficient, ct and ss
+* are set to all zero bytes and 1 is returned.
 **************************************************/
 static inline int crypto_kem_enc_derand(uint8_t *ct, uint8_t *ss,
                                         const uint8_t *pk,
                                         const uint8_t *coins)
 {
-	uint8_t msg[NTRUPLUS_N / 8 + NTRUPLUS_SYMBYTES];
-	uint8_t buf1[NTRUPLUS_SYMBYTES + NTRUPLUS_N / 4];
-	uint8_t buf2[NTRUPLUS_POLYBYTES];
+	uint8_t msg[HASH_H_INBYTES];
+	uint8_t buf1[HASH_H_OUTBYTES];
+	uint8_t buf2[HASH_G_INBYTES];
     
     poly c, h, r, m;
+
+    if(poly_frombytes(&h, pk))
+    {
+        for (size_t i = 0; i < NTRUPLUS_CIPHERTEXTBYTES; i++)
+            ct[i] = 0;
+        secure_clear(ss, NTRUPLUS_SSBYTES);
+
+        return 1;
+    }
     
     for (size_t i = 0; i < NTRUPLUS_N / 8; i++)
         msg[i] = coins[i];
@@ -188,12 +226,17 @@ static inline int crypto_kem_enc_derand(uint8_t *ct, uint8_t *ss,
     poly_sotp_encode(&m, msg, buf2);
     poly_ntt(&m);
     
-    poly_frombytes(&h, pk);
     poly_basemul_add(&c, &h, &r, &m);
     poly_tobytes(ct, &c);
     
     for (size_t i = 0; i < NTRUPLUS_SSBYTES; i++)
         ss[i] = buf1[i];
+
+    secure_clear(msg, sizeof msg);
+    secure_clear(buf1, sizeof buf1);
+    secure_clear(buf2, sizeof buf2);
+    secure_clear(&r, sizeof r);
+    secure_clear(&m, sizeof m);
     
     return 0;
 }
@@ -212,14 +255,22 @@ static inline int crypto_kem_enc_derand(uint8_t *ct, uint8_t *ss,
 *              - const uint8_t *pk: input public key
 *                (array of CRYPTO_PUBLICKEYBYTES bytes)
 *
-* Returns 0 on success.
+* Returns 0 on success. If pk contains a non-canonical coefficient, ct and ss
+* are set to all zero bytes and 1 is returned.
 **************************************************/
-int crypto_kem_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk)
+int crypto_kem_enc(unsigned char *ct, unsigned char *ss,
+                   const unsigned char *pk)
 {
     uint8_t coins[NTRUPLUS_N / 8];
+    int ret;
 
-    if (randombytes(coins, sizeof coins) != 0) return -1;
-    return crypto_kem_enc_derand(ct, ss, pk, coins);
+    if (randombytes(coins, sizeof coins) != 0) {
+        secure_clear(coins, sizeof coins);
+        return -1;
+    }
+    ret = crypto_kem_enc_derand(ct, ss, pk, coins);
+    secure_clear(coins, sizeof coins);
+    return ret;
 }
 
 /*************************************************
@@ -238,26 +289,32 @@ int crypto_kem_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk)
 *
 * Returns 0 on success, 1 on failure.
 **************************************************/
-int crypto_kem_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk)
+int crypto_kem_dec(unsigned char *ss, const unsigned char *ct,
+                   const unsigned char *sk)
 {
-	uint8_t msg[NTRUPLUS_N / 8 + NTRUPLUS_SYMBYTES];
-	uint8_t buf1[NTRUPLUS_POLYBYTES];
-	uint8_t buf2[NTRUPLUS_POLYBYTES];
-	uint8_t buf3[NTRUPLUS_POLYBYTES + NTRUPLUS_SYMBYTES];
-    
-    int8_t fail;
+	uint8_t msg[HASH_H_INBYTES];
+	uint8_t buf1[HASH_G_INBYTES];
+	uint8_t buf2[HASH_G_INBYTES];
+	uint8_t buf3[HASH_H_OUTBYTES];
+
+    int8_t fail = 1;
     
     poly c, f, hinv;
     poly r1, r2;
     poly m1, m2;
-    
-    poly_frombytes(&c, ct);
-    poly_frombytes(&f, sk);
-    poly_frombytes(&hinv, sk + NTRUPLUS_POLYBYTES);
+
+    if(poly_frombytes(&c, ct) ||
+       poly_frombytes(&f, sk) ||
+       poly_frombytes(&hinv, sk + NTRUPLUS_POLYBYTES))
+    {
+        secure_clear(ss, NTRUPLUS_SSBYTES);
+
+        goto cleanup;
+    }
     
     poly_basemul(&m1, &c, &f);
     poly_invntt(&m1);
-    poly_crepmod3(&m1, &m1);
+    poly_crepmod3(&m1);
     
     m2 = m1;
     poly_ntt(&m2);
@@ -268,7 +325,7 @@ int crypto_kem_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk)
     hash_g(buf2, buf1);
     fail = poly_sotp_decode(msg, &m1, buf2);
     
-    for (size_t i = 0; i < NTRUPLUS_SYMBYTES; i++)
+    for (size_t i = 0; i < HASH_F_OUTBYTES; i++)
         msg[i + NTRUPLUS_N / 8] = sk[i + 2 * NTRUPLUS_POLYBYTES];
     
     hash_h(buf3, msg);
@@ -281,6 +338,19 @@ int crypto_kem_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk)
     
     for (size_t i = 0; i < NTRUPLUS_SSBYTES; i++)
         ss[i] = buf3[i] & ~(-fail);
-    
+
+cleanup:
+    secure_clear(msg, sizeof msg);
+    secure_clear(buf1, sizeof buf1);
+    secure_clear(buf2, sizeof buf2);
+    secure_clear(buf3, sizeof buf3);
+    secure_clear(&c, sizeof c);
+    secure_clear(&f, sizeof f);
+    secure_clear(&hinv, sizeof hinv);
+    secure_clear(&r1, sizeof r1);
+    secure_clear(&r2, sizeof r2);
+    secure_clear(&m1, sizeof m1);
+    secure_clear(&m2, sizeof m2);
+
     return fail;
 }

data/vendor/NTRUplus/NTRU+864/ntt.c

@@ -115,8 +115,9 @@ static inline int16_t fqmul(int16_t a, int16_t b)
 /*************************************************
 * Name:        fqinv
 *
-* Description: Computes the multiplicative inverse of a value in the
-*              finite field Z_q.
+* Description: Computes the multiplicative inverse in Z_q using Fermat's
+*              little theorem. The exponent q-2 = 3455 is evaluated using
+*              a shortest addition chain of length 15 (OEIS A003313).
 *
 * Arguments:   - int16_t a: input value a mod q
 *
@@ -124,32 +125,27 @@ static inline int16_t fqmul(int16_t a, int16_t b)
 **************************************************/
 static inline int16_t fqinv(int16_t a)
 {
-	int16_t t1, t2, t3;
-
-	t1 = fqmul(a, a);    // 10
-	t2 = fqmul(t1, t1);  // 100
-	t2 = fqmul(t2, t2);  // 1000
-	t3 = fqmul(t2, t2);  // 10000
-
-	t1 = fqmul(t1, t2);  // 1010
-
-	t2 = fqmul(t1, t3);  // 11010
-	t2 = fqmul(t2, t2);  // 110100
-	t2 = fqmul(t2, a);   // 110101
-
-	t1 = fqmul(t1, t2);  // 111111
-
-	t2 = fqmul(t2, t2);  // 1101010
-	t2 = fqmul(t2, t2);  // 11010100
-	t2 = fqmul(t2, t2);  // 110101000
-	t2 = fqmul(t2, t2);  // 1101010000
-	t2 = fqmul(t2, t2);  // 11010100000
-	t2 = fqmul(t2, t2);  // 110101000000
-	t2 = fqmul(t2, t1);  // 110101111111
-
-	t2 = fqmul(NTRUPLUS_RINV, t2);
-
-	return t2;
+	int16_t t0, t1;
+
+	t0 = fqmul(a, a);    // 10
+	t0 = fqmul(t0, t0);  // 100
+	t0 = fqmul(t0, t0);  // 1000
+	t0 = fqmul(t0, t0);  // 10000
+	t1 = fqmul(t0, a);   // 10001
+
+	t0 = fqmul(t0, t0);  // 100000
+	t0 = fqmul(t0, t0);  // 1000000
+	t0 = fqmul(t0, t0);  // 10000000
+	t1 = fqmul(t0, t1);  // 10010001
+
+	t0 = fqmul(t1, t0);  // 100010001
+	t1 = fqmul(t0, t1);  // 110100010
+	t1 = fqmul(t1, t0);  // 1010110011
+	t0 = fqmul(t1, t1);  // 10101100110
+	t0 = fqmul(t0, t0);  // 101011001100
+	t0 = fqmul(t0, t1);  // 110101111111
+
+	return fqmul(NTRUPLUS_RINV, t0);
 }
 
 /*************************************************

data/vendor/NTRUplus/NTRU+864/poly.c

@@ -42,7 +42,6 @@ void poly_tobytes(uint8_t r[NTRUPLUS_POLYBYTES], const poly *a)
 {
 	int16_t t[2];
 
-	#pragma GCC unroll 2
 	for(size_t i = 0; i < NTRUPLUS_N/2; i++)
 	{
 		t[0] = a->coeffs[2*i];
@@ -65,14 +64,25 @@ void poly_tobytes(uint8_t r[NTRUPLUS_POLYBYTES], const poly *a)
 * Arguments:   - poly *r:          pointer to output polynomial
 *              - const uint8_t *a: pointer to input byte array
 *                                  (of NTRUPLUS_POLYBYTES bytes)
+*
+* Returns 0 on success, 1 if any coefficient is greater than or equal to q.
 **************************************************/
-void poly_frombytes(poly *r, const uint8_t a[NTRUPLUS_POLYBYTES])
+int poly_frombytes(poly *r, const uint8_t a[NTRUPLUS_POLYBYTES])
 {
+	uint32_t fail = 0;
+
 	for(size_t i = 0; i < NTRUPLUS_N/2; i++)
 	{
-		r->coeffs[2*i]   = ((a[3*i+0] >> 0) | ((uint16_t)a[3*i+1] << 8)) & 0xFFF;
-		r->coeffs[2*i+1] = ((a[3*i+1] >> 4) | ((uint16_t)a[3*i+2] << 4)) & 0xFFF;
+		const uint16_t t0 = ((a[3*i+0] >> 0) | ((uint16_t)a[3*i+1] << 8)) & 0xFFF;
+		const uint16_t t1 = ((a[3*i+1] >> 4) | ((uint16_t)a[3*i+2] << 4)) & 0xFFF;
+
+		r->coeffs[2*i]   = t0;
+		r->coeffs[2*i+1] = t1;
+		fail |= (uint32_t)(NTRUPLUS_Q - 1) - t0;
+		fail |= (uint32_t)(NTRUPLUS_Q - 1) - t1;
 	}
+
+	return fail >> 31;
 }
 
 /*************************************************
@@ -147,6 +157,7 @@ int poly_sotp_decode(uint8_t msg[NTRUPLUS_N/8], const poly *a, const uint8_t buf
 	uint8_t t1, t2, t3;
 	uint16_t t4;
 	uint32_t r = 0;
+	volatile uint8_t mask;
 
 	for(size_t i = 0; i < NTRUPLUS_N / 8; i++)
 	{
@@ -172,6 +183,11 @@ int poly_sotp_decode(uint8_t msg[NTRUPLUS_N/8], const poly *a, const uint8_t buf
 	r = r >> 1;
 	r = (-(uint32_t)r) >> 31;
 
+	mask = (uint8_t)(r - 1);
+
+	for (size_t i = 0; i < NTRUPLUS_N / 8; i++)
+		msg[i] &= mask;
+
 	return r;
 }
 
@@ -290,13 +306,12 @@ void poly_sub(poly *r, const poly *a, const poly *b)
 *
 * Description: Multiply polynomial by 3; no modular reduction is performed
 *
-* Arguments: - poly *r: pointer to output polynomial
-*            - const poly *a: pointer to input polynomial
+* Arguments: - poly *r: pointer to input/output polynomial
 **************************************************/
-void poly_triple(poly *r, const poly *a) 
+void poly_triple(poly *r)
 {
 	for(int i = 0; i < NTRUPLUS_N; ++i)
-		r->coeffs[i] = 3*a->coeffs[i];
+		r->coeffs[i] *= 3;
 }
 
 /*************************************************
@@ -304,11 +319,10 @@ void poly_triple(poly *r, const poly *a)
 *
 * Description: Compute modulus 3 operation to polynomial
 *
-* Arguments: - poly *r: pointer to output polynomial
-*            - const poly *a: pointer to input polynomial
+* Arguments: - poly *r: pointer to input/output polynomial
 **************************************************/
-void poly_crepmod3(poly *r, const poly *a)
+void poly_crepmod3(poly *r)
 {
 	for(int i = 0; i < NTRUPLUS_N; i++)
-		r->coeffs[i] = crepmod3(a->coeffs[i]);
+		r->coeffs[i] = crepmod3(r->coeffs[i]);
 }

data/vendor/NTRUplus/NTRU+864/poly.h

@@ -13,7 +13,7 @@ typedef struct{
 } poly;
 
 void poly_tobytes(uint8_t r[NTRUPLUS_POLYBYTES], const poly *a);
-void poly_frombytes(poly *r, const uint8_t a[NTRUPLUS_POLYBYTES]);
+int  poly_frombytes(poly *r, const uint8_t a[NTRUPLUS_POLYBYTES]);
 
 void poly_cbd1(poly *r, const uint8_t buf[NTRUPLUS_N/4]);
 void poly_sotp_encode(poly *r, const uint8_t msg[NTRUPLUS_N/8], const uint8_t buf[NTRUPLUS_N/4]);
@@ -25,7 +25,7 @@ int  poly_baseinv(poly *r, const poly *a);
 void poly_basemul(poly *r, const poly *a, const poly *b);
 void poly_basemul_add(poly *r, const poly *a, const poly *b, const poly *c);
 void poly_sub(poly *r, const poly *a, const poly *b);
-void poly_triple(poly *r, const poly *a);
-void poly_crepmod3(poly *r, const poly *a);
+void poly_triple(poly *r);
+void poly_crepmod3(poly *r);
 
 #endif

data/vendor/NTRUplus/NTRU+864/randombytes.h

@@ -4,6 +4,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
+/* KpqC bindings propagate failures from the operating-system entropy source. */
 int randombytes(uint8_t *out, size_t outlen);
 
 #endif

data/vendor/NTRUplus/NTRU+864/symmetric.c

@@ -1,16 +1,8 @@
+#include "util.h"
 #include <string.h>
 #include "symmetric.h"
 #include "fips202/fips202.h"
 
-#define HASH_F_INBYTES  (NTRUPLUS_POLYBYTES)
-#define HASH_F_OUTBYTES (32)
-
-#define HASH_G_INBYTES  (NTRUPLUS_POLYBYTES)
-#define HASH_G_OUTBYTES (NTRUPLUS_N / 4)
-
-#define HASH_H_INBYTES  (NTRUPLUS_N / 8 + NTRUPLUS_SYMBYTES)
-#define HASH_H_OUTBYTES (NTRUPLUS_SSBYTES + NTRUPLUS_N / 4)
-
 void hash_f(uint8_t *buf, const uint8_t *msg)
 {
     uint8_t data[1 + HASH_F_INBYTES];
@@ -27,6 +19,7 @@ void hash_g(uint8_t *buf, const uint8_t *msg)
     data[0] = 0x01;
     memcpy(data + 1, msg, HASH_G_INBYTES);
     shake256(buf, HASH_G_OUTBYTES, data, HASH_G_INBYTES + 1);
+    secure_clear(data, sizeof data);
 }
 
 void hash_h(uint8_t *buf, const uint8_t *msg)
@@ -36,4 +29,5 @@ void hash_h(uint8_t *buf, const uint8_t *msg)
     data[0] = 0x02;
     memcpy(data + 1, msg, HASH_H_INBYTES);
     shake256(buf, HASH_H_OUTBYTES, data, HASH_H_INBYTES + 1);
+    secure_clear(data, sizeof data);
 }

data/vendor/NTRUplus/NTRU+864/symmetric.h

@@ -3,10 +3,20 @@
 
 #include <stddef.h>
 #include <stdint.h>
+#include "api.h"
 #include "params.h"
 
-void hash_f(uint8_t *buf, const uint8_t *msg);
-void hash_g(uint8_t *buf, const uint8_t *msg);
-void hash_h(uint8_t *buf, const uint8_t *msg);
+#define HASH_F_INBYTES  (NTRUPLUS_POLYBYTES)
+#define HASH_F_OUTBYTES (NTRUPLUS_SYMBYTES)
+
+#define HASH_G_INBYTES  (NTRUPLUS_POLYBYTES)
+#define HASH_G_OUTBYTES (NTRUPLUS_N / 4)
+
+#define HASH_H_INBYTES  (NTRUPLUS_N / 8 + NTRUPLUS_SYMBYTES)
+#define HASH_H_OUTBYTES (NTRUPLUS_SSBYTES + NTRUPLUS_N / 4)
+
+NTRUPLUS_INTERNAL void hash_f(uint8_t *buf, const uint8_t *msg);
+NTRUPLUS_INTERNAL void hash_g(uint8_t *buf, const uint8_t *msg);
+NTRUPLUS_INTERNAL void hash_h(uint8_t *buf, const uint8_t *msg);
 
 #endif /* SYMMETRIC_H */

data/vendor/NTRUplus/NTRU+864/util.h

@@ -0,0 +1,15 @@
+#ifndef NTRUPLUS_UTIL_H
+#define NTRUPLUS_UTIL_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+static inline void secure_clear(void *v, size_t len)
+{
+    volatile uint8_t *p = v;
+
+    while (len-- > 0)
+        *p++ = 0;
+}
+
+#endif /* NTRUPLUS_UTIL_H */

data/vendor/SMAUG-T/src/cbd.c

@@ -24,7 +24,7 @@ static uint32_t load24_littleendian(const uint8_t x[3]) {
  *              - const uint8_t buf[SMAUGT_CBDSEED_BYTES]: pointer to input byte
  *              array
  *
- * Specification: Implements Algorithm 7, spCBD1.
+ * Specification: Implements @[KS X 123456, Algorithm 7, spCBD1]
  **************************************************/
 #define sp_cbd1 SMAUGT_NAMESPACE(sp_cbd1)
 static void sp_cbd1(poly *r, const uint8_t buf[SMAUGT_CBDSEED_BYTES]) {
@@ -81,7 +81,7 @@ static uint32_t load32_littleendian(const uint8_t x[4]) {
  *              - const uint8_t buf[SMAUGT_CBDSEED_BYTES]: pointer to input byte
  *              array
  *
- * Specification: Implements Algorithm 9, CBD.
+ * Specification: Implements @[KS X 123456, Algorithm 9, CBD]
  **************************************************/
 #define cbd SMAUGT_NAMESPACE(cbd)
 static void cbd(poly *r, const uint8_t buf[SMAUGT_CBDSEED_BYTES]) {
@@ -113,7 +113,7 @@ static void cbd(poly *r, const uint8_t buf[SMAUGT_CBDSEED_BYTES]) {
  *              - const uint8_t buf[SMAUGT_CBDSEED_BYTES]: pointer to input byte
  *              array
  *
- * Specification: Implements Algorithm 8, spCBD2.
+ * Specification: Implements @[KS X 123456, Algorithm 8, spCBD2]
  **************************************************/
 #define sp_cbd2 SMAUGT_NAMESPACE(sp_cbd2)
 static void sp_cbd2(poly *r, const uint8_t buf[SMAUGT_CBDSEED_BYTES]) {
@@ -146,7 +146,7 @@ static void sp_cbd2(poly *r, const uint8_t buf[SMAUGT_CBDSEED_BYTES]) {
  *              - const uint8_t buf[SMAUGT_CBDSEED_BYTES]: pointer to input byte
  *              array
  *
- * Specification: Implements Algorithm 6, spCBD.
+ * Specification: Implements @[KS X 123456, Algorithm 6, spCBD]
  **************************************************/
 void sp_cbd(poly *r, const uint8_t buf[SMAUGT_CBDSEED_BYTES]) {
 #if SMAUGT_MODE == SMAUGT_MODE1 || SMAUGT_MODE == SMAUGT_MODET

data/vendor/SMAUG-T/src/ciphertext.c

@@ -10,7 +10,7 @@
  * Arguments:   - polyvec *a: pointer to inout vector a. This should be
  *                already initialized.
  *
- * Specification: Implements Algorithm 12, Round1.
+ * Specification: Implements @[KS X 123456, Algorithm 12, Round1]
  **************************************************/
 #define round1 SMAUGT_NAMESPACE(round1)
 static inline void round1(polyvec *a) {
@@ -50,7 +50,7 @@ void computeC1(polyvec *c1, const polyvec A[SMAUGT_K], const polyvec *r) {
  * Arguments:   - poly *a: pointer to an input/output vector a. This should be
  *              already initialized.
  *
- * Specification: Implements Algorithm 13, Round2.
+ * Specification: Implements @[KS X 123456, Algorithm 13, Round2]
  **************************************************/
 #define round2 SMAUGT_NAMESPACE(round2)
 static inline void round2(poly *a) {

data/vendor/SMAUG-T/src/dg.c

@@ -53,7 +53,7 @@ static void load64_littleendian(uint64_t *out, size_t outlen,
  *              - const uint8_t *seed: pointer to input seed (of length
  *              SMAUGT_CRYPTO_BYTES+1)
  *
- * Specification: Implements Algorithm 11, dGaussianPoly.
+ * Specification: Implements @[KS X 123456, Algorithm 11, dGaussianPoly]
  **************************************************/
 int d_gaussian_poly(poly *op, const uint8_t *seed) {
     unsigned int i = 0, j = 0, k = 0;
@@ -99,7 +99,7 @@ int d_gaussian_poly(poly *op, const uint8_t *seed) {
  *              - const uint8_t seed[SMAUGT_CRYPTO_BYTES]: pointer to input byte
  * array
  *
- * Specification: Implements Algorithm 10, dGaussian.
+ * Specification: Implements @[KS X 123456, Algorithm 10, dGaussian]
  **************************************************/
 void d_gaussian(polyvec *op, const uint8_t seed[SMAUGT_CRYPTO_BYTES]) {
     unsigned int i;

data/vendor/SMAUG-T/src/hwt.c

@@ -16,8 +16,8 @@
 #define load16_littleendian SMAUGT_NAMESPACE(load16_littleendian)
 static void load16_littleendian(uint16_t *out, size_t outlen,
                                 const uint8_t *in) {
-    size_t pos = 0;
-    for (size_t i = 0; i < outlen; ++i) {
+    int pos = 0;
+    for (int i = 0; i < outlen; ++i) {
         out[i] = ((uint16_t)(in[pos])) | ((uint16_t)(in[pos + 1]) << 8);
         pos += 2;
     }
@@ -39,7 +39,7 @@ static void load16_littleendian(uint16_t *out, size_t outlen,
  *              - const uint16_t *seed: pointer to input seed (of length
  *              SMAUGT_HWTSEEDBYTES/2)
  *
- * Specification: Implements Algorithm 4, RejSampleMod.
+ * Specification: Implements @[KS X 123456, Algorithm 4, RejSampleMod]
  **************************************************/
 #define rej_sample_mod SMAUGT_NAMESPACE(rej_sample_mod)
 static int rej_sample_mod(int16_t si[SMAUGT_N], const uint16_t *rand) {
@@ -79,7 +79,7 @@ static int rej_sample_mod(int16_t si[SMAUGT_N], const uint16_t *rand) {
  *              - const uint8_t *seed: pointer to input seed (of length
  *              SMAUGT_CRYPTO_BYTES + 2)
  *
- * Specification: Implements Algorithm 3, HWT.
+ * Specification: Implements @[KS X 123456, Algorithm 3, HWT]
  **************************************************/
 int hwt(int16_t *res, const uint8_t *seed) {
     unsigned int i;