kpqc 0.1.0 → 0.2.0

data/vendor/AIMer/sign.h

@@ -14,8 +14,8 @@
 typedef struct tape_t
 {
   gf pt_share;
-  gf t_shares[AIMER_L];
-  gf a_share;
+  gf y_shares[AIMER_L];
+  gf a_shares[AIMER_L + 1];
   gf c_share;
 } tape_t;
 
@@ -23,10 +23,10 @@ typedef struct proof_t
 {
   uint8_t reveal_path[AIMER_LOGN][AIMER_SEED_SIZE];
   uint8_t missing_commitment[AIMER_COMMIT_SIZE];
-  uint8_t delta_pt_bytes[AIM2_NUM_BYTES_FIELD];
-  uint8_t delta_ts_bytes[AIMER_L][AIM2_NUM_BYTES_FIELD];
-  uint8_t delta_c_bytes[AIM2_NUM_BYTES_FIELD];
-  uint8_t missing_alpha_share_bytes[AIM2_NUM_BYTES_FIELD];
+  uint8_t delta_pt_bytes[AIM3_NUM_BYTES_FIELD];
+  uint8_t delta_ys_bytes[AIMER_L][AIM3_NUM_BYTES_FIELD];
+  uint8_t delta_c_bytes[AIM3_NUM_BYTES_FIELD];
+  uint8_t missing_alpha_share_bytes[AIMER_L + 1][AIM3_NUM_BYTES_FIELD];
 } proof_t;
 
 typedef struct signature_t

data/vendor/AIMer/tree.c

@@ -12,14 +12,17 @@ void expand_tree(uint8_t nodes[2 * AIMER_N - 1][AIMER_SEED_SIZE],
 {
   size_t node_index;
   hash_instance ctx;
+  uint8_t rep_byte = (uint8_t)rep_index;
 
   memcpy(nodes[0], seed, AIMER_SEED_SIZE);
   for (node_index = 1; node_index < AIMER_N; node_index++)
   {
+    uint8_t node_byte = (uint8_t)node_index;
+
     hash_init_prefix(&ctx, HASH_PREFIX_4);
     hash_update(&ctx, salt, AIMER_SALT_SIZE);
-    hash_update(&ctx, (const uint8_t*)&rep_index, sizeof(uint8_t));
-    hash_update(&ctx, (const uint8_t*)&node_index, sizeof(uint8_t));
+    hash_update(&ctx, &rep_byte, sizeof(rep_byte));
+    hash_update(&ctx, &node_byte, sizeof(node_byte));
     hash_update(&ctx, nodes[node_index - 1], AIMER_SEED_SIZE);
     hash_final(&ctx);
 
@@ -50,6 +53,7 @@ void reconstruct_tree(uint8_t nodes[2 * AIMER_N - 2][AIMER_SEED_SIZE],
 {
   size_t index, depth, path;
   hash_instance ctx;
+  uint8_t rep_byte = (uint8_t)rep_index;
 
   for (depth = 1; depth < AIMER_LOGN; depth++)
   {
@@ -58,10 +62,12 @@ void reconstruct_tree(uint8_t nodes[2 * AIMER_N - 2][AIMER_SEED_SIZE],
 
     for (index = (1U << depth); index < (2U << depth); index++)
     {
+      uint8_t index_byte = (uint8_t)index;
+
       hash_init_prefix(&ctx, HASH_PREFIX_4);
       hash_update(&ctx, salt, AIMER_SALT_SIZE);
-      hash_update(&ctx, (const uint8_t*)&rep_index, sizeof(uint8_t));
-      hash_update(&ctx, (const uint8_t*)&index, sizeof(uint8_t));
+      hash_update(&ctx, &rep_byte, sizeof(rep_byte));
+      hash_update(&ctx, &index_byte, sizeof(index_byte));
       hash_update(&ctx, nodes[index - 2], AIMER_SEED_SIZE);
       hash_final(&ctx);
 

data/vendor/AIMer/tree.h

@@ -7,7 +7,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#define expand_tree AIMER_NAMESPACE(expand_trees)
+#define expand_tree AIMER_NAMESPACE(expand_tree)
 void expand_tree(uint8_t nodes[2 * AIMER_N - 1][AIMER_SEED_SIZE],
                  const uint8_t salt[AIMER_SALT_SIZE], size_t rep_index,
                  const uint8_t seed[AIMER_SEED_SIZE]);

data/vendor/HAETAE/include/fixpoint.h

@@ -32,29 +32,29 @@ void fixpoint_add(fp96_76 *xy, const fp96_76 *x, const fp96_76 *y);
 
 static inline void renormalize(fp96_76 *x) {
   x->limb48[1] += x->limb48[0] >> 48;
-  x->limb48[0] &= (1ULL << 48) - 1;
+  x->limb48[0] &= (UINT64_C(1) << 48) - 1;
 }
 
 static inline int64_t smulh48(int64_t a, uint64_t b) {
-#ifndef __SIZEOF_INT128__
+#ifdef __SIZEOF_INT128__
+  return (((int128)a * (int128)b) + ((int128)1 << 48) - 1) >> 48;
+#else
   int64_t ah = a >> 24;
   int64_t al = a - (ah << 24);
   int64_t bl = b & ((1 << 24) - 1);
   int64_t bh = b >> 24;
 
-  int64_t res = (al * bl) >> 24;
-  res += al * bh + ah * bl + (1 << 23); // rounding
-  res >>= 24;
+  int64_t res = (al * bl + ((1 << 24) - 1)) >> 24; // ceiling in low word
+  res += al * bh + ah * bl;
+  res = (res + ((1 << 24) - 1)) >> 24; // ceiling in high word
   return res + (ah * bh);
-#else
-  return ((int128)a * (int128)b + (1ULL << 47)) >> 48; // rounding
 #endif
 }
 
 static inline void mul64(uint64_t r[2], const uint64_t b, const uint64_t a) {
 #ifndef __SIZEOF_INT128__
-  uint64_t al = a & ((1ULL << 32) - 1), bl = b & ((1ULL << 32) - 1),
-           ah = a >> 32, bh = b >> 32;
+  uint64_t al = a & ((UINT64_C(1) << 32) - 1),
+           bl = b & ((UINT64_C(1) << 32) - 1), ah = a >> 32, bh = b >> 32;
   r[0] = a * b;
   r[1] = ah * bl + al * bh + ((al * bl) >> 32);
   r[1] >>= 32;
@@ -68,7 +68,7 @@ static inline void mul64(uint64_t r[2], const uint64_t b, const uint64_t a) {
 
 static inline void sq64(uint64_t r[2], const uint64_t a) {
 #ifndef __SIZEOF_INT128__
-  uint64_t al = a & ((1ULL << 32) - 1), ah = a >> 32;
+  uint64_t al = a & ((UINT64_C(1) << 32) - 1), ah = a >> 32;
   r[0] = a * a;
   r[1] = ah * al * 2 + ((al * al) >> 32);
   r[1] >>= 32;
@@ -84,7 +84,7 @@ static inline void mul48(uint64_t r[2], const uint64_t b, const uint64_t a) {
   mul64(r, b, a);
   r[1] <<= 16;
   r[1] ^= r[0] >> 48;
-  r[0] &= (1ULL << 48) - 1;
+  r[0] &= (UINT64_C(1) << 48) - 1;
 }
 
 static inline void mulacc48(uint64_t r[2], const uint64_t b, const uint64_t a) {
@@ -100,7 +100,7 @@ static inline void sq48(uint64_t r[2], const uint64_t a) {
 
   r[1] <<= 16;
   r[1] ^= r[0] >> 48;
-  r[0] &= (1ULL << 48) - 1;
+  r[0] &= (UINT64_C(1) << 48) - 1;
 }
 
 static inline void fixpoint_mul_high(fp96_76 *xy, const fp96_76 *x,
@@ -112,9 +112,9 @@ static inline void fixpoint_mul_high(fp96_76 *xy, const fp96_76 *x,
   xy->limb48[1] += tmp[0];
 
   // shift right by 28, rounding
-  xy->limb48[0] += 1UL << 27;
+  xy->limb48[0] += UINT64_C(1) << 27;
   xy->limb48[0] >>= 28;
-  xy->limb48[0] += (xy->limb48[1] << 20) & ((1ULL << 48) - 1);
+  xy->limb48[0] += (xy->limb48[1] << 20) & ((UINT64_C(1) << 48) - 1);
   xy->limb48[1] >>= 28;
 
   xy->limb48[1] += tmp[1] << 20;

data/vendor/HAETAE/include/rans_byte.h

@@ -48,7 +48,8 @@
 // Between this and our byte-aligned emission, we use 31 (not 32!) bits.
 // This is done intentionally because exact reciprocals for 31-bit uints
 // fit in 32-bit uints: this permits some optimizations during encoding.
-#define RANS_BYTE_L (1u << 23) // lower bound of our normalization interval
+#define RANS_BYTE_L                                                            \
+  (UINT32_C(1) << 23) // lower bound of our normalization interval
 
 // State for a rANS encoder. Yep, that's all there is to it.
 typedef uint32_t RansState;
@@ -123,7 +124,7 @@ static inline int RansDecInit(RansState *r, uint8_t **pptr) {
 
 // Returns the current cumulative frequency (map it to a symbol yourself!)
 static inline uint32_t RansDecGet(RansState *r, uint32_t scale_bits) {
-  return *r & ((1u << scale_bits) - 1);
+  return *r & ((UINT32_C(1) << scale_bits) - 1);
 }
 
 // Advances in the bit stream by "popping" a single symbol with range start
@@ -132,7 +133,7 @@ static inline uint32_t RansDecGet(RansState *r, uint32_t scale_bits) {
 static inline void RansDecAdvance(RansState *r, uint8_t **pptr,
                                   const uint8_t *end, uint32_t start,
                                   uint32_t freq, uint32_t scale_bits) {
-  uint32_t mask = (1u << scale_bits) - 1;
+  uint32_t mask = (UINT32_C(1) << scale_bits) - 1;
 
   // s, x = D(x)
   uint32_t x = *r;
@@ -176,8 +177,8 @@ typedef struct {
 static inline void RansEncSymbolInit(RansEncSymbol *s, uint32_t start,
                                      uint32_t freq, uint32_t scale_bits) {
   RansAssert(scale_bits <= 16);
-  RansAssert(start <= (1u << scale_bits));
-  RansAssert(freq <= (1u << scale_bits) - start);
+  RansAssert(start <= (UINT32_C(1) << scale_bits));
+  RansAssert(freq <= (UINT32_C(1) << scale_bits) - start);
 
   // Say M := 1 << scale_bits.
   //
@@ -225,17 +226,17 @@ static inline void RansEncSymbolInit(RansEncSymbol *s, uint32_t start,
     //
     // so we have start = bias + 1 - M, or equivalently
     //   bias = start + M - 1.
-    s->rcp_freq = ~0u;
+    s->rcp_freq = ~UINT32_C(0);
     s->rcp_shift = 0;
     s->bias = start + (1 << scale_bits) - 1;
   } else {
     // Alverson, "Integer Division using reciprocals"
     // shift=ceil(log2(freq))
     uint32_t shift = 0;
-    while (freq > (1u << shift))
+    while (freq > (UINT32_C(1) << shift))
       shift++;
 
-    s->rcp_freq = (uint32_t)(((1ull << (shift + 31)) + freq - 1) / freq);
+    s->rcp_freq = (uint32_t)(((UINT64_C(1) << (shift + 31)) + freq - 1) / freq);
     s->rcp_shift = shift - 1;
 
     // With these values, 'q' is the correct quotient, so we
@@ -295,7 +296,7 @@ static inline void RansDecAdvanceSymbol(RansState *r, uint8_t **pptr,
 // scale_bits". No renormalization or output happens.
 static inline void RansDecAdvanceStep(RansState *r, uint32_t start,
                                       uint32_t freq, uint32_t scale_bits) {
-  uint32_t mask = (1u << scale_bits) - 1;
+  uint32_t mask = (UINT32_C(1) << scale_bits) - 1;
 
   // s, x = D(x)
   uint32_t x = *r;

data/vendor/HAETAE/src/decompose.c

@@ -9,14 +9,18 @@
  * Name:        decompose_z1
  *
  * Description: For finite field element r, compute high and lowbits
- *              hb, lb such that r = hb * b + lb with -b/4 < lb <= b/4.
+ *              hb, lb such that r = hb * b + lb with -b/2 <= lb < b/2,
+ *              for b = alpha = 256.
  *
  * Arguments:   - int32_t r: input element
  *              - int32_t *lowbits: pointer to output element lb
  *              - int32_t *highbits: pointer to output element hb
+ *
+ * Specification: Implements @[Algorithm 20, HighBits] and
+ *                @[Algorithm 21, LowBits] with alpha = 256
  **************************************************/
 void decompose_z1(int32_t *highbits, int32_t *lowbits, const int32_t r) {
-  const int alpha = 256; // Algorithm parameter.
+  const int alpha = 256; // TODO magic numbers!
   const int log_alpha = 8;
 
   int32_t lb, center;
@@ -38,7 +42,7 @@ void decompose_z1(int32_t *highbits, int32_t *lowbits, const int32_t r) {
  * Arguments:   - int32_t r: input element
  *              - int32_t *highbits: pointer to output element hb
  *
- * Specification: Implements Algorithm 20, DecomposeHint.
+ * Specification: Implements @[Algorithm 22, DecomposeHint]
  **************************************************/
 
 void decompose_hint(int32_t *highbits, const int32_t r) {
@@ -64,7 +68,7 @@ void decompose_hint(int32_t *highbits, const int32_t r) {
  *
  * Returns:     - a1
  *
- * Specification: Implements Algorithm 17, DecomposeVK.
+ * Specification: Implements @[Algorithm 19, DecomposeVK]
  **************************************************/
 int32_t decompose_vk(int32_t *a0, const int32_t a) {
   *a0 = a & 1;

data/vendor/HAETAE/src/encoding.c

@@ -9,7 +9,7 @@
 #include <string.h>
 
 #define SCALE_BITS 10
-#define SCALE (1u << SCALE_BITS)
+#define SCALE (UINT32_C(1) << SCALE_BITS)
 
 #if HAETAE_MODE == HAETAE_MODE2
 #define M_H 13
@@ -522,7 +522,7 @@ static uint16_t symbol_hb_z1[SCALE] = {
  * Arguments:   - uint8_t *buf: pointer to output buffer
  *              - const int32_t *h: pointer to polynomial vector h
  *
- * Specification: Implements Algorithm 38, EncodeH.
+ * Specification: Implements @[Algorithm 44, EncodeH]
  **************************************************/
 uint16_t encode_h(uint8_t *buf, const int32_t *h) {
   size_t size_encoded;
@@ -570,7 +570,7 @@ uint16_t encode_h(uint8_t *buf, const int32_t *h) {
  * Arguments:   - int32_t *h: pointer to polynomial vector h
  *              - uint8_t *buf: pointer to output buffer
  *
- * Specification: Implements Algorithm 39, DecodeH.
+ * Specification: Implements @[Algorithm 45, DecodeH]
  **************************************************/
 uint16_t decode_h(int32_t *h, const uint8_t *buf, uint16_t size_in) {
   size_t size_used;
@@ -616,7 +616,7 @@ uint16_t decode_h(int32_t *h, const uint8_t *buf, uint16_t size_in) {
  * Arguments:   - uint8_t *buf: pointer to output buffer
  *              - const int32_t *hb_z1: pointer to polynomial vector
  *
- * Specification: Implements Algorithm 40, EncodeHBz1.
+ * Specification: Implements @[Algorithm 46, EncodeHBz1]
  **************************************************/
 uint16_t encode_hb_z1(uint8_t *buf, const int32_t *hb_z1) {
   size_t size_encoded;
@@ -661,7 +661,7 @@ uint16_t encode_hb_z1(uint8_t *buf, const int32_t *hb_z1) {
  * Arguments:   - int32_t *hb_z1: pointer to polynomial vector HighBits(z1)
  *              - uint8_t *buf: pointer to output buffer
  *
- * Specification: Implements Algorithm 41, DecodeHBz1.
+ * Specification: Implements @[Algorithm 47, DecodeHBz1]
  **************************************************/
 uint16_t decode_hb_z1(int32_t *hb_z1, const uint8_t *buf, uint16_t size_in) {
   size_t size_used;

data/vendor/HAETAE/src/fft.c

@@ -208,7 +208,7 @@ int32_t complex_fp_sqabs(complex_fp32_16 x) {
  *
  * Arguments:   - complex_fp32_16 data[FFT_N]
  *
- * Specification: Implements Algorithm 43, FFT.
+ * Specification: Implements @[Algorithm 49, FFT]
  **************************************************/
 void fft(complex_fp32_16 data[FFT_N]) {
   unsigned int r, m, md2, n, k, even, odd, twid;

data/vendor/HAETAE/src/fips202.c

@@ -48,18 +48,30 @@ static void store64(uint8_t x[8], uint64_t u) {
 
 /* Keccak round constants */
 const uint64_t KeccakF_RoundConstants[NROUNDS] = {
-    (uint64_t)0x0000000000000001ULL, (uint64_t)0x0000000000008082ULL,
-    (uint64_t)0x800000000000808aULL, (uint64_t)0x8000000080008000ULL,
-    (uint64_t)0x000000000000808bULL, (uint64_t)0x0000000080000001ULL,
-    (uint64_t)0x8000000080008081ULL, (uint64_t)0x8000000000008009ULL,
-    (uint64_t)0x000000000000008aULL, (uint64_t)0x0000000000000088ULL,
-    (uint64_t)0x0000000080008009ULL, (uint64_t)0x000000008000000aULL,
-    (uint64_t)0x000000008000808bULL, (uint64_t)0x800000000000008bULL,
-    (uint64_t)0x8000000000008089ULL, (uint64_t)0x8000000000008003ULL,
-    (uint64_t)0x8000000000008002ULL, (uint64_t)0x8000000000000080ULL,
-    (uint64_t)0x000000000000800aULL, (uint64_t)0x800000008000000aULL,
-    (uint64_t)0x8000000080008081ULL, (uint64_t)0x8000000000008080ULL,
-    (uint64_t)0x0000000080000001ULL, (uint64_t)0x8000000080008008ULL};
+    (uint64_t)UINT64_C(0x0000000000000001),
+    (uint64_t)UINT64_C(0x0000000000008082),
+    (uint64_t)UINT64_C(0x800000000000808a),
+    (uint64_t)UINT64_C(0x8000000080008000),
+    (uint64_t)UINT64_C(0x000000000000808b),
+    (uint64_t)UINT64_C(0x0000000080000001),
+    (uint64_t)UINT64_C(0x8000000080008081),
+    (uint64_t)UINT64_C(0x8000000000008009),
+    (uint64_t)UINT64_C(0x000000000000008a),
+    (uint64_t)UINT64_C(0x0000000000000088),
+    (uint64_t)UINT64_C(0x0000000080008009),
+    (uint64_t)UINT64_C(0x000000008000000a),
+    (uint64_t)UINT64_C(0x000000008000808b),
+    (uint64_t)UINT64_C(0x800000000000008b),
+    (uint64_t)UINT64_C(0x8000000000008089),
+    (uint64_t)UINT64_C(0x8000000000008003),
+    (uint64_t)UINT64_C(0x8000000000008002),
+    (uint64_t)UINT64_C(0x8000000000000080),
+    (uint64_t)UINT64_C(0x000000000000800a),
+    (uint64_t)UINT64_C(0x800000008000000a),
+    (uint64_t)UINT64_C(0x8000000080008081),
+    (uint64_t)UINT64_C(0x8000000000008080),
+    (uint64_t)UINT64_C(0x0000000080000001),
+    (uint64_t)UINT64_C(0x8000000080008008)};
 
 /*************************************************
  * Name:        KeccakF1600_StatePermute
@@ -389,7 +401,7 @@ static unsigned int keccak_absorb(uint64_t s[25], unsigned int pos,
 static void keccak_finalize(uint64_t s[25], unsigned int pos, unsigned int r,
                             uint8_t p) {
   s[pos / 8] ^= (uint64_t)p << 8 * (pos % 8);
-  s[r / 8 - 1] ^= 1ULL << 63;
+  s[r / 8 - 1] ^= UINT64_C(1) << 63;
 }
 
 /*************************************************
@@ -458,7 +470,7 @@ static void keccak_absorb_once(uint64_t s[25], unsigned int r,
     s[i / 8] ^= (uint64_t)in[i] << 8 * (i % 8);
 
   s[i / 8] ^= (uint64_t)p << 8 * (i % 8);
-  s[(r - 1) / 8] ^= 1ULL << 63;
+  s[(r - 1) / 8] ^= UINT64_C(1) << 63;
 }
 
 /*************************************************

data/vendor/HAETAE/src/fixpoint.c

@@ -7,14 +7,14 @@
 #include <stdlib.h>
 
 static void __cneg(fp96_76 *x, const uint8_t sign) {
-  x->limb48[0] ^= (-(int64_t)sign) & ((1ULL << 48) - 1);
+  x->limb48[0] ^= (-(int64_t)sign) & ((UINT64_C(1) << 48) - 1);
   x->limb48[1] ^= -(int64_t)sign;
   x->limb48[0] += sign;
   renormalize(x);
 }
 
 static void __copy_cneg(fp96_76 *y, const fp96_76 *x, const uint8_t sign) {
-  y->limb48[0] = ((-(int64_t)sign) & ((1ULL << 48) - 1)) ^ x->limb48[0];
+  y->limb48[0] = ((-(int64_t)sign) & ((UINT64_C(1) << 48) - 1)) ^ x->limb48[0];
   ;
   y->limb48[1] = x->limb48[1] ^ (-(int64_t)sign);
   y->limb48[0] += sign;
@@ -34,13 +34,13 @@ static void fixpoint_mul(fp96_76 *xy, const fp96_76 *x, const fp96_76 *y) {
   mulacc48(&xy->limb48[0], x->limb48[1], y->limb48[0]);
 
   // shift right by 28, rounding
-  xy->limb48[0] += 1UL << 27;
+  xy->limb48[0] += UINT64_C(1) << 27;
   xy->limb48[0] >>= 28;
-  xy->limb48[0] += (xy->limb48[1] << 20) & ((1ULL << 48) - 1);
+  xy->limb48[0] += (xy->limb48[1] << 20) & ((UINT64_C(1) << 48) - 1);
   xy->limb48[1] >>= 28;
 
   mul64(tmp, x->limb48[1], y->limb48[1]);
-  xy->limb48[0] += (tmp[0] << 20) & ((1ULL << 48) - 1);
+  xy->limb48[0] += (tmp[0] << 20) & ((UINT64_C(1) << 48) - 1);
   xy->limb48[1] += (tmp[0] >> 28) + (tmp[1] << 36);
 
   renormalize(xy);
@@ -62,7 +62,7 @@ static void fixpoint_sub(fp96_76 *xminy, const fp96_76 *x, const fp96_76 *y) {
 
 static void fixpoint_sub_from_threehalves(fp96_76 *x) {
   __cneg(x, 1);
-  x->limb48[1] += 3ULL << 27; // left shift by 28 would be "3"
+  x->limb48[1] += UINT64_C(3) << 27; // left shift by 28 would be "3"
   renormalize(x);
 }
 
@@ -71,7 +71,7 @@ void fixpoint_square(fp96_76 *sqx, const fp96_76 *x) {
   sq48(&sqx->limb48[0], x->limb48[0]);
 
   // shift right by 48, rounding
-  // sqx->limb48[0] += 1ULL << 47;
+  // sqx->limb48[0] += UINT64_C(1) << 47;
   sqx->limb48[0] >>= 48;
   sqx->limb48[0] += sqx->limb48[1];
 
@@ -81,13 +81,13 @@ void fixpoint_square(fp96_76 *sqx, const fp96_76 *x) {
   sqx->limb48[1] = tmp[1] << 1;
 
   // shift right by 28, rounding
-  // sqx->limb48[0] += 1ULL << 27;
+  // sqx->limb48[0] += UINT64_C(1) << 27;
   sqx->limb48[0] >>= 28;
-  sqx->limb48[0] += (sqx->limb48[1] << 20) & ((1ULL << 48) - 1);
+  sqx->limb48[0] += (sqx->limb48[1] << 20) & ((UINT64_C(1) << 48) - 1);
   sqx->limb48[1] >>= 28;
 
   sq64(tmp, x->limb48[1]);
-  sqx->limb48[0] += (tmp[0] << 20) & ((1ULL << 48) - 1);
+  sqx->limb48[0] += (tmp[0] << 20) & ((UINT64_C(1) << 48) - 1);
   sqx->limb48[1] += (tmp[0] >> 28) + (tmp[1] << 36);
 
   renormalize(sqx);
@@ -96,17 +96,20 @@ void fixpoint_square(fp96_76 *sqx, const fp96_76 *x) {
 // start_cube = hex(round(2^64/(sqrt((K + L)*N + 2)^3)))
 // start_times_threehalfs = hex(round(2^64 * 2/(3 * sqrt((K + L)*N + 2))))
 #if HAETAE_MODE == HAETAE_MODE2
-const fp96_76 start_cube = {.limb48 = {0x770077e2e41aULL, 0x1162ULL}};
+const fp96_76 start_cube = {
+    .limb48 = {UINT64_C(0x770077e2e41a), UINT64_C(0x1162)}};
 const fp96_76 start_times_threehalves = {
-    .limb48 = {0x693861ad937bULL, 0x9caa56ULL}};
+    .limb48 = {UINT64_C(0x693861ad937b), UINT64_C(0x9caa56)}};
 #elif HAETAE_MODE == HAETAE_MODE3
-const fp96_76 start_cube = {.limb48 = {0x1a2935cfae68ULL, 0x978ULL}};
+const fp96_76 start_cube = {
+    .limb48 = {UINT64_C(0x1a2935cfae68), UINT64_C(0x978)}};
 const fp96_76 start_times_threehalves = {
-    .limb48 = {0x7ad215218533ULL, 0x7ff1c9ULL}};
+    .limb48 = {UINT64_C(0x7ad215218533), UINT64_C(0x7ff1c9)}};
 #elif HAETAE_MODE == HAETAE_MODE5
-const fp96_76 start_cube = {.limb48 = {0x700ff3e8890dULL, 0x702ULL}};
+const fp96_76 start_cube = {
+    .limb48 = {UINT64_C(0x700ff3e8890d), UINT64_C(0x702)}};
 const fp96_76 start_times_threehalves = {
-    .limb48 = {0x5768588eed31ULL, 0x73bd40ULL}};
+    .limb48 = {UINT64_C(0x5768588eed31), UINT64_C(0x73bd40)}};
 #endif
 
 // implements Newton's method
@@ -131,9 +134,9 @@ int32_t fixpoint_mul_rnd13(const uint64_t x, const fp96_76 *y,
   int64_t res;
   fp96_76 tmp, xx;
   xx.limb48[1] = x >> 32;
-  xx.limb48[0] = (x & ((1ULL << 32) - 1)) << 16;
+  xx.limb48[0] = (x & ((UINT64_C(1) << 32) - 1)) << 16;
   fixpoint_mul(&tmp, &xx, y);
-  res = (tmp.limb48[1] + (1UL << 14)) >> 15; // rounding
+  res = (tmp.limb48[1] + (UINT64_C(1) << 14)) >> 15; // rounding
   return (1 - 2 * (int32_t)sign) * res;
 }
 

data/vendor/HAETAE/src/ntt.c

@@ -45,6 +45,8 @@ static const int32_t zetas[HAETAE_N] = {
  *              order.
  *
  * Arguments:   - uint32_t p[HAETAE_N]: input/output coefficient array
+ *
+ * Specification: Implements @[Algorithm 2, NTT]
  **************************************************/
 void ntt(int32_t a[HAETAE_N]) {
   unsigned int len, start, j, k;

data/vendor/HAETAE/src/packing.c

@@ -19,7 +19,7 @@
  *              containg b
  *              - const uint8_t seed[]: seed for A'
  *
- * Specification: Implements Algorithm 21, PackVK.
+ * Specification: Implements @[Algorithm 23, PackVK]
  **************************************************/
 void pack_vk(uint8_t vk[HAETAE_CRYPTO_PUBLICKEYBYTES], polyveck *b,
              const uint8_t seed[HAETAE_SEEDBYTES]) {
@@ -42,7 +42,7 @@ void pack_vk(uint8_t vk[HAETAE_CRYPTO_PUBLICKEYBYTES], polyveck *b,
  *              - polyveck *b: polynomial vector of length HAETAE_K containg b
  *              - const uint8_t vk[]: output byte array
  *
- * Specification: Implements Algorithm 22, UnpackVK.
+ * Specification: Implements @[Algorithm 24, UnpackVK]
  **************************************************/
 void unpack_vk(polyvecl A[HAETAE_K],
                const uint8_t vk[HAETAE_CRYPTO_PUBLICKEYBYTES]) {
@@ -84,7 +84,7 @@ void unpack_vk(polyvecl A[HAETAE_K],
  *                starting at offset 1)
  *              - const polyveck *s1: polyveck pointer containing s1
  *
- * Specification: Implements Algorithm 23, PackSK.
+ * Specification: Implements @[Algorithm 25, PackSK]
  **************************************************/
 void pack_sk(uint8_t sk[HAETAE_CRYPTO_SECRETKEYBYTES],
              const uint8_t vk[HAETAE_CRYPTO_PUBLICKEYBYTES], const polyvecm *s0,
@@ -121,7 +121,7 @@ void pack_sk(uint8_t sk[HAETAE_CRYPTO_SECRETKEYBYTES],
  *              - polyveck s1: output polyveck pointer for s1
  *              - const uint8_t sk[]: byte array containing bit-packed sk
  *
- * Specification: Implements Algorithm 24, UnpackSK.
+ * Specification: Implements @[Algorithm 26, UnPackSK]
  **************************************************/
 void unpack_sk(polyvecl A[HAETAE_K], polyvecm *s0, polyveck *s1, uint8_t *key,
                const uint8_t sk[HAETAE_CRYPTO_SECRETKEYBYTES]) {
@@ -162,7 +162,7 @@ void unpack_sk(polyvecl A[HAETAE_K], polyvecm *s0, polyveck *s1, uint8_t *key,
  *              - const polyveck *h: pointer t vector h of length HAETAE_K
  * Returns 1 in case the signature packing failed; otherwise 0.
  *
- * Specification: Implements Algorithm 25, PackSig.
+ * Specification: Implements @[Algorithm 27, PackSIG]
  **************************************************/
 int pack_sig(uint8_t sig[HAETAE_CRYPTO_BYTES], const poly *c,
              const polyvecl *lowbits_z1, const polyvecl *highbits_z1,
@@ -237,7 +237,7 @@ int pack_sig(uint8_t sig[HAETAE_CRYPTO_BYTES], const poly *c,
  *
  * Returns 1 in case of malformed signature; otherwise 0.
  *
- * Specification: Implements Algorithm 26, UnpackSig.
+ * Specification: Implements @[Algorithm 28, UnpackSIG]
  **************************************************/
 int unpack_sig(poly *c, polyvecl *lowbits_z1, polyvecl *highbits_z1,
                polyveck *h, const uint8_t sig[HAETAE_CRYPTO_BYTES]) {
@@ -293,7 +293,7 @@ int unpack_sig(poly *c, polyvecl *lowbits_z1, polyvecl *highbits_z1,
  *              HAETAE_POLYQ_PACKEDBYTES bytes
  *              - const poly *a: pointer to input polynomial
  *
- * Specification: Implements Algorithm 27, PackPolyQ.
+ * Specification: Implements @[Algorithm 29, PackPolyQ]
  **************************************************/
 void pack_poly_q(uint8_t *r, const poly *a) {
   unsigned int i;
@@ -343,7 +343,7 @@ void pack_poly_q(uint8_t *r, const poly *a) {
  * Arguments:   - poly *r: pointer to output polynomial
  *              - const uint8_t *a: byte array with bit-packed polynomial
  *
- * Specification: Implements Algorithm 28, UnpackPolyQ.
+ * Specification: Implements @[Algorithm 30, UnpackPolyQ]
  **************************************************/
 void unpack_poly_q(poly *r, const uint8_t *a) {
   unsigned int i;
@@ -395,7 +395,7 @@ void unpack_poly_q(poly *r, const uint8_t *a) {
  *              HAETAE_POLYETA_PACKEDBYTES bytes
  *              - const poly *a: pointer to input polynomial
  *
- * Specification: Implements Algorithm 29, PackPolyEta.
+ * Specification: Implements @[Algorithm 31, PackPolyEta]
  **************************************************/
 void pack_poly_eta(uint8_t *r, const poly *a) {
   unsigned int i;
@@ -421,7 +421,7 @@ void pack_poly_eta(uint8_t *r, const poly *a) {
  * Arguments:   - poly *r: pointer to output polynomial
  *              - const uint8_t *a: byte array with bit-packed polynomial
  *
- * Specification: Implements Algorithm 30, UnpackPolyEta.
+ * Specification: Implements @[Algorithm 32, UnpackPolyEta]
  **************************************************/
 void unpack_poly_eta(poly *r, const uint8_t *a) {
   unsigned int i;
@@ -454,7 +454,7 @@ void unpack_poly_eta(poly *r, const uint8_t *a) {
  *                            HAETAE_POLYETA_PACKEDBYTES bytes
  *              - const poly *a: pointer to input polynomial
  *
- * Specification: Implements Algorithm 31, PackPoly2Eta.
+ * Specification: Implements @[Algorithm 33, PackPoly2Eta]
  **************************************************/
 void pack_poly2_eta(uint8_t *r, const poly *a) {
   unsigned int i;
@@ -483,7 +483,7 @@ void pack_poly2_eta(uint8_t *r, const poly *a) {
  * Arguments:   - poly *r: pointer to output polynomial
  *              - const uint8_t *a: byte array with bit-packed polynomial
  *
- * Specification: Implements Algorithm 32, UnpackPoly2Eta.
+ * Specification: Implements @[Algorithm 34, UnpackPoly2Eta]
  **************************************************/
 void unpack_poly2_eta(poly *r, const uint8_t *a) {
   unsigned int i;
@@ -516,7 +516,7 @@ void unpack_poly2_eta(poly *r, const uint8_t *a) {
  * Arguments:   - uint8_t *buf: pointer to output bytes array
  *              - const polyveck *v: a vector of polynomials
  *
- * Specification: Implements Algorithm 33, PackVecHighBits.
+ * Specification: Implements @[Algorithm 35, PackVecHighBits]
  **************************************************/
 void pack_vec_highbits(uint8_t *buf, const polyveck *v) {
   unsigned int i;
@@ -533,7 +533,7 @@ void pack_vec_highbits(uint8_t *buf, const polyveck *v) {
  * Arguments:   - uint8_t *buf: pointer to output bytes array
  *              - const poly *v: a polynomial
  *
- * Specification: Implements Algorithm 34, PackPolyHighBits.
+ * Specification: Implements @[Algorithm 36, PackPolyHighBits]
  **************************************************/
 void pack_poly_highbits(uint8_t *buf, const poly *a) {
   unsigned int i;
@@ -582,7 +582,7 @@ void pack_poly_highbits(uint8_t *buf, const poly *a) {
  * Arguments:   - uint8_t *buf: pointer to output bytes array
  *              - const poly *a: a polynomial
  *
- * Specification: Implements Algorithm 35, PackPolyLsb.
+ * Specification: Implements @[Algorithm 37, PackPolyLsb]
  **************************************************/
 void pack_poly_lsb(uint8_t *buf, const poly *a) {
   unsigned int i;