kpqc 0.1.0

data/vendor/AIMer/field256.c

@@ -0,0 +1,564 @@
+// SPDX-License-Identifier: MIT
+
+#include "field.h"
+#include <stddef.h>
+#include <stdint.h>
+
+void gf_to_bytes(uint8_t *out, const gf in)
+{
+  int i, j;
+  for (i = 0; i < AIM2_NUM_WORDS_FIELD; i++)
+  {
+    uint64_t u = in[i];
+    for (j = 0; j < 8; j++)
+    {
+      *out++ = u;
+      u >>= 8;
+    }
+  }
+}
+
+void gf_from_bytes(gf out, const uint8_t *in)
+{
+  int i, j;
+  for (i = 0; i < AIM2_NUM_WORDS_FIELD; i++)
+  {
+    uint64_t u = 0;
+    for (j = 7; j >= 0; j--)
+    {
+      u = (u << 8) | in[8 * i + j];
+    }
+    out[i] = u;
+  }
+}
+
+void gf_set0(gf a)
+{
+  a[0] = 0;
+  a[1] = 0;
+  a[2] = 0;
+  a[3] = 0;
+}
+
+void gf_copy(gf out, const gf in)
+{
+  out[0] = in[0];
+  out[1] = in[1];
+  out[2] = in[2];
+  out[3] = in[3];
+}
+
+void gf_add(gf c, const gf a, const gf b)
+{
+  c[0] = a[0] ^ b[0];
+  c[1] = a[1] ^ b[1];
+  c[2] = a[2] ^ b[2];
+  c[3] = a[3] ^ b[3];
+}
+
+static void poly64_mul(uint64_t *z1, uint64_t *z0, uint64_t x0, uint64_t y0)
+{
+  const uint64_t C0 = 0x5555555555555555;
+  const uint64_t C1 = 0x3333333333333333;
+  const uint64_t C2 = 0x0f0f0f0f0f0f0f0f;
+  const uint64_t C3 = 0x00ff00ff00ff00ff;
+  const uint64_t C4 = 0x0000ffff0000ffff;
+  const uint64_t C5 = 0x00000000ffffffff;
+  uint64_t x1, x2, x3, x4, x5, x6, x7;
+  uint64_t y1, y2, y3, y4, y5, y6, y7;
+  uint64_t f0, f1, f2, f3, f4, f5, f6, f7;
+  uint64_t g0, g1, g2, g3, g4, g5, g6, g7;
+  uint64_t s, t;
+
+  x1 = x0 ^ (x0 >> 32); // will ignore outside C5
+  x2 = ((x0 ^ (x0 >> 16)) & C4) | ((x1 ^ (x1 << 16)) & (C4 << 16));
+  x3 = ((x0 ^ (x0 >> 8)) & C3) | ((x1 ^ (x1 <<  8)) & (C3 <<  8));
+  x4 = x2 ^ (x2 >> 8);  // will ignore outside C3
+  x5 = ((x0 ^ (x0 >> 4)) & C2) | ((x1 ^ (x1 <<  4)) & (C2 <<  4));
+  x6 = ((x2 ^ (x2 >> 4)) & C2) | ((x3 ^ (x3 <<  4)) & (C2 <<  4));
+  x7 = x4 ^ (x4 >> 4);  // will ignore outside C2
+  s = ((x0 >> 2) ^ x2) & C1;
+  x0 ^= s << 2;
+  x2 ^= s;
+  s = ((x1 >> 2) ^ x3) & C1;
+  x1 ^= s << 2;
+  x3 ^= s;
+  s = ((x4 >> 2) ^ x6) & C1;
+  x4 ^= s << 2;
+  x6 ^= s;
+  s = ((x5 >> 2) ^ x7) & C1;
+  x5 ^= s << 2;
+  x7 ^= s;
+  s = ((x0 >> 1) ^ x1) & C0;
+  x0 ^= s << 1;
+  x1 ^= s;
+  s = ((x2 >> 1) ^ x3) & C0;
+  x2 ^= s << 1;
+  x3 ^= s;
+  s = ((x4 >> 1) ^ x5) & C0;
+  x4 ^= s << 1;
+  x5 ^= s;
+  s = ((x6 >> 1) ^ x7) & C0;
+  x6 ^= s << 1;
+  x7 ^= s;
+
+  y1 = y0 ^ (y0 >> 32);
+  y2 = ((y0 ^ (y0 >> 16)) & C4) | ((y1 ^ (y1 << 16)) & (C4 << 16));
+  y3 = ((y0 ^ (y0 >> 8)) & C3) | ((y1 ^ (y1 << 8)) & (C3 << 8));
+  y4 = y2 ^ (y2 >> 8);
+  y5 = ((y0 ^ (y0 >> 4)) & C2) | ((y1 ^ (y1 << 4)) & (C2 << 4));
+  y6 = ((y2 ^ (y2 >> 4)) & C2) | ((y3 ^ (y3 << 4)) & (C2 << 4));
+  y7 = y4 ^ (y4 >> 4);
+  s = ((y0 >> 2) ^ y2) & C1;
+  y0 ^= s << 2;
+  y2 ^= s;
+  s = ((y1 >> 2) ^ y3) & C1;
+  y1 ^= s << 2;
+  y3 ^= s;
+  s = ((y4 >> 2) ^ y6) & C1;
+  y4 ^= s << 2;
+  y6 ^= s;
+  s = ((y5 >> 2) ^ y7) & C1;
+  y5 ^= s << 2;
+  y7 ^= s;
+  s = ((y0 >> 1) ^ y1) & C0;
+  y0 ^= s << 1;
+  y1 ^= s;
+  s = ((y2 >> 1) ^ y3) & C0;
+  y2 ^= s << 1;
+  y3 ^= s;
+  s = ((y4 >> 1) ^ y5) & C0;
+  y4 ^= s << 1;
+  y5 ^= s;
+  s = ((y6 >> 1) ^ y7) & C0;
+  y6 ^= s << 1;
+  y7 ^= s;
+
+  f0 = x0 & y0;
+  f1 = (x0 & y1) ^ (x1 & y0);
+  f2 = (x0 & y2) ^ (x1 & y1) ^ (x2 & y0);
+  f3 = (x0 & y3) ^ (x1 & y2) ^ (x2 & y1) ^ (x3 & y0);
+  g0 = (x1 & y3) ^ (x2 & y2) ^ (x3 & y1);
+  g1 = (x2 & y3) ^ (x3 & y2);
+  g2 = x3 & y3;
+
+  f4 = x4 & y4;
+  f5 = (x4 & y5) ^ (x5 & y4);
+  f6 = (x4 & y6) ^ (x5 & y5) ^ (x6 & y4);
+  f7 = (x4 & y7) ^ (x5 & y6) ^ (x6 & y5) ^ (x7 & y4);
+  g4 = (x5 & y7) ^ (x6 & y6) ^ (x7 & y5);
+  g5 = (x6 & y7) ^ (x7 & y6);
+  g6 = x7 & y7;
+
+  s = ((f0 >> 1) ^ f1) & C0;
+  f0 ^= s << 1;
+  f1 ^= s;
+  s = ((f2 >> 1) ^ f3) & C0;
+  f2 ^= s << 1;
+  f3 ^= s;
+  s = ((f0 >> 2) ^ f2) & C1;
+  f0 ^= s << 2;
+  f2 ^= s;
+  s = ((f1 >> 2) ^ f3) & C1;
+  f1 ^= s << 2;
+  f3 ^= s;
+  s = ((g0 >> 1) ^ g1) & C0;
+  g0 ^= s << 1;
+  g1 ^= s;
+  s = (g2 >> 1) & C0;
+  g2 ^= s << 1;
+  g3 = s;
+  s = ((g0 >> 2) ^ g2) & C1;
+  g0 ^= s << 2;
+  g2 ^= s;
+  s = ((g1 >> 2) ^ g3) & C1;
+  g1 ^= s << 2;
+  g3 ^= s;
+
+  s = ((f4 >> 1) ^ f5) & C0;
+  f4 ^= s << 1;
+  f5 ^= s;
+  s = ((f6 >> 1) ^ f7) & C0;
+  f6 ^= s << 1;
+  f7 ^= s;
+  s = ((f4 >> 2) ^ f6) & C1;
+  f4 ^= s << 2;
+  f6 ^= s;
+  s = ((f5 >> 2) ^ f7) & C1;
+  f5 ^= s << 2;
+  f7 ^= s;
+  s = ((g4 >> 1) ^ g5) & C0;
+  g4 ^= s << 1;
+  g5 ^= s;
+  s = (g6 >> 1) & C0;
+  g6 ^= s << 1;
+  g7 = s;
+  s = ((g4 >> 2) ^ g6) & C1;
+  g4 ^= s << 2;
+  g6 ^= s;
+  s = ((g5 >> 2) ^ g7) & C1;
+  g5 ^= s << 2;
+  g7 ^= s;
+
+  t = f0 ^ g0;
+  f0 ^= ((f5 ^ t) & C2) << 4;
+  g0 ^= (g5 ^ (t >> 4)) & C2;
+  t = f1 ^ g1;
+  f1 ^= (f5 ^ (t << 4)) & (C2 << 4);
+  g1 ^= ((g5 ^ t) >> 4) & C2;
+  t = f2 ^ g2;
+  f2 ^= ((f6 ^ t) & C2) << 4;
+  g2 ^= (g6 ^ (t >> 4)) & C2;
+  t = f3 ^ g3;
+  f3 ^= (f6 ^ (t << 4)) & (C2 << 4);
+  g3 ^= ((g6 ^ t) >> 4) & C2;
+  t = f4 ^ g4;
+  f4 ^= ((f7 ^ t) & C2) << 4;
+  g4 ^= (g7 ^ (t >> 4)) & C2;
+
+  t = f0 ^ g0;
+  f0 ^= ((f3 ^ t) & C3) << 8;
+  g0 ^= (g3 ^ (t >> 8)) & C3;
+  t = f1 ^ g1;
+  f1 ^= (f3 ^ (t << 8)) & (C3 << 8);
+  g1 ^= ((g3 ^ t) >> 8) & C3;
+  t = f2 ^ g2;
+  f2 ^= ((f4 ^ t) & C3) << 8;
+  g2 ^= (g4 ^ (t >> 8)) & C3;
+
+  t = f0 ^ g0;
+  f0 ^= ((f2 ^ t) & C4) << 16;
+  g0 ^= (g2 ^ (t >> 16)) & C4;
+  t = f1 ^ g1;
+  f1 ^= (f2 ^ (t << 16)) & (C4 << 16);
+  g1 ^= ((g2 ^ t) >> 16) & C4;
+
+  t = f0 ^ g0;
+  f0 ^= ((t ^ f1) & C5) << 32;
+  g0 ^= ((t >> 32) ^ g1) & C5;
+
+  *z0 = f0;
+  *z1 = g0;
+}
+
+void gf_mul(gf c, const gf a, const gf b)
+{
+  uint64_t t[4] = {0,};
+  uint64_t add[4] = {0,};
+  uint64_t temp[8] = {0,};
+
+  poly64_mul(&t[0], &temp[0], a[0], b[0]);
+  poly64_mul(&t[2], &t[1], a[1], b[1]);
+  t[0] ^= t[1];
+
+  poly64_mul(&t[3], &t[1], a[2], b[2]);
+  t[1] ^= t[2];
+
+  poly64_mul(&temp[7], &t[2], a[3], b[3]);
+  t[2] ^= t[3];
+
+  temp[6] = temp[7] ^ t[2];
+  temp[3] = t[2] ^ t[1];
+  temp[2] = t[1] ^ t[0];
+  temp[1] = t[0] ^ temp[0];
+
+  poly64_mul(&t[1], &t[0], (a[0] ^ a[1]), (b[0] ^ b[1]));
+  temp[1] ^= t[0];
+  temp[2] ^= t[1];
+
+  poly64_mul(&t[1], &t[0], (a[2] ^ a[3]), (b[2] ^ b[3]));
+  temp[3] ^= t[0];
+  temp[6] ^= t[1];
+
+  temp[5] = temp[7] ^ temp[3];
+  temp[4] = temp[6] ^ temp[2];
+  temp[3] ^= temp[1];
+  temp[2] ^= temp[0];
+
+  add[0] = a[0] ^ a[2];
+  add[1] = a[1] ^ a[3];
+  add[2] = b[0] ^ b[2];
+  add[3] = b[1] ^ b[3];
+  poly64_mul(&t[1], &t[0], add[0], add[2]);
+  poly64_mul(&t[3], &t[2], add[1], add[3]);
+  t[1] ^= t[2];
+  t[2] = t[1] ^ t[3];
+  t[1] ^= t[0];
+
+  temp[2] ^= t[0];
+  temp[3] ^= t[1];
+  temp[4] ^= t[2];
+  temp[5] ^= t[3];
+
+  poly64_mul(&t[1], &t[0], (add[0] ^ add[1]), (add[2] ^ add[3]));
+  temp[3] ^= t[0];
+  temp[4] ^= t[1];
+
+  t[0] = temp[4] ^ ((temp[7] >> 54) ^ (temp[7] >> 59) ^ (temp[7] >> 62));
+
+  c[3] = temp[3] ^ temp[7];
+  c[3] ^= (temp[7] << 10) | (temp[6] >> 54);
+  c[3] ^= (temp[7] <<  5) | (temp[6] >> 59);
+  c[3] ^= (temp[7] <<  2) | (temp[6] >> 62);
+
+  c[2] = temp[2] ^ temp[6];
+  c[2] ^= (temp[6] << 10) | (temp[5] >> 54);
+  c[2] ^= (temp[6] <<  5) | (temp[5] >> 59);
+  c[2] ^= (temp[6] <<  2) | (temp[5] >> 62);
+
+  c[1] = temp[1] ^ temp[5];
+  c[1] ^= (temp[5] << 10) | (t[0] >> 54);
+  c[1] ^= (temp[5] <<  5) | (t[0] >> 59);
+  c[1] ^= (temp[5] <<  2) | (t[0] >> 62);
+
+  c[0] = temp[0] ^ t[0];
+  c[0] ^= (t[0] << 10);
+  c[0] ^= (t[0] <<  5);
+  c[0] ^= (t[0] <<  2);
+}
+
+void gf_mul_add(gf c, const gf a, const gf b)
+{
+  uint64_t t[4] = {0,};
+  uint64_t add[4] = {0,};
+  uint64_t temp[8] = {0,};
+
+  poly64_mul(&t[0], &temp[0], a[0], b[0]);
+  poly64_mul(&t[2], &t[1], a[1], b[1]);
+  t[0] ^= t[1];
+
+  poly64_mul(&t[3], &t[1], a[2], b[2]);
+  t[1] ^= t[2];
+
+  poly64_mul(&temp[7], &t[2], a[3], b[3]);
+  t[2] ^= t[3];
+
+  temp[6] = temp[7] ^ t[2];
+  temp[3] = t[2] ^ t[1];
+  temp[2] = t[1] ^ t[0];
+  temp[1] = t[0] ^ temp[0];
+
+  poly64_mul(&t[1], &t[0], (a[0] ^ a[1]), (b[0] ^ b[1]));
+  temp[1] ^= t[0];
+  temp[2] ^= t[1];
+
+  poly64_mul(&t[1], &t[0], (a[2] ^ a[3]), (b[2] ^ b[3]));
+  temp[3] ^= t[0];
+  temp[6] ^= t[1];
+
+  temp[5] = temp[7] ^ temp[3];
+  temp[4] = temp[6] ^ temp[2];
+  temp[3] ^= temp[1];
+  temp[2] ^= temp[0];
+
+  add[0] = a[0] ^ a[2];
+  add[1] = a[1] ^ a[3];
+  add[2] = b[0] ^ b[2];
+  add[3] = b[1] ^ b[3];
+  poly64_mul(&t[1], &t[0], add[0], add[2]);
+  poly64_mul(&t[3], &t[2], add[1], add[3]);
+  t[1] ^= t[2];
+  t[2] = t[1] ^ t[3];
+  t[1] ^= t[0];
+
+  temp[2] ^= t[0];
+  temp[3] ^= t[1];
+  temp[4] ^= t[2];
+  temp[5] ^= t[3];
+
+  poly64_mul(&t[1], &t[0], (add[0] ^ add[1]), (add[2] ^ add[3]));
+  temp[3] ^= t[0];
+  temp[4] ^= t[1];
+
+  t[0] = temp[4] ^ ((temp[7] >> 54) ^ (temp[7] >> 59) ^ (temp[7] >> 62));
+
+  c[3] ^= temp[3] ^ temp[7];
+  c[3] ^= (temp[7] << 10) | (temp[6] >> 54);
+  c[3] ^= (temp[7] <<  5) | (temp[6] >> 59);
+  c[3] ^= (temp[7] <<  2) | (temp[6] >> 62);
+
+  c[2] ^= temp[2] ^ temp[6];
+  c[2] ^= (temp[6] << 10) | (temp[5] >> 54);
+  c[2] ^= (temp[6] <<  5) | (temp[5] >> 59);
+  c[2] ^= (temp[6] <<  2) | (temp[5] >> 62);
+
+  c[1] ^= temp[1] ^ temp[5];
+  c[1] ^= (temp[5] << 10) | (t[0] >> 54);
+  c[1] ^= (temp[5] <<  5) | (t[0] >> 59);
+  c[1] ^= (temp[5] <<  2) | (t[0] >> 62);
+
+  c[0] ^= temp[0] ^ t[0];
+  c[0] ^= (t[0] << 10);
+  c[0] ^= (t[0] <<  5);
+  c[0] ^= (t[0] <<  2);
+}
+
+static void poly64_sqr(uint64_t *z1, uint64_t *z0, uint64_t x)
+{
+  const uint64_t C0 = 0x5555555555555555;
+  const uint64_t C1 = 0x3333333333333333;
+  const uint64_t C2 = 0x0f0f0f0f0f0f0f0f;
+  const uint64_t C3 = 0x00ff00ff00ff00ff;
+  const uint64_t C4 = 0x0000ffff0000ffff;
+  const uint64_t C5 = 0x00000000ffffffff;
+  uint64_t y = x >> 32;
+  x &= C5;
+  x = (x | (x << 16)) & C4;
+  y = (y | (y << 16)) & C4;
+  x = (x | (x << 8)) & C3;
+  y = (y | (y << 8)) & C3;
+  x = (x | (x << 4)) & C2;
+  y = (y | (y << 4)) & C2;
+  x = (x | (x << 2)) & C1;
+  y = (y | (y << 2)) & C1;
+  x = (x | (x << 1)) & C0;
+  y = (y | (y << 1)) & C0;
+  *z0 = x;
+  *z1 = y;
+}
+
+void gf_sqr(gf c, const gf a)
+{
+  uint64_t t = 0;
+  uint64_t temp[8] = {0,};
+
+  poly64_sqr(&temp[1], &temp[0], a[0]);
+  poly64_sqr(&temp[3], &temp[2], a[1]);
+  poly64_sqr(&temp[5], &temp[4], a[2]);
+  poly64_sqr(&temp[7], &temp[6], a[3]);
+
+  t = temp[4] ^ ((temp[7] >> 54) ^ (temp[7] >> 59) ^ (temp[7] >> 62));
+
+  c[3] = temp[3] ^ temp[7];
+  c[3] ^= (temp[7] << 10) | (temp[6] >> 54);
+  c[3] ^= (temp[7] <<  5) | (temp[6] >> 59);
+  c[3] ^= (temp[7] <<  2) | (temp[6] >> 62);
+
+  c[2] = temp[2] ^ temp[6];
+  c[2] ^= (temp[6] << 10) | (temp[5] >> 54);
+  c[2] ^= (temp[6] <<  5) | (temp[5] >> 59);
+  c[2] ^= (temp[6] <<  2) | (temp[5] >> 62);
+
+  c[1] = temp[1] ^ temp[5];
+  c[1] ^= (temp[5] << 10) | (t >> 54);
+  c[1] ^= (temp[5] <<  5) | (t >> 59);
+  c[1] ^= (temp[5] <<  2) | (t >> 62);
+
+  c[0] = temp[0] ^ t;
+  c[0] ^= (t << 10);
+  c[0] ^= (t <<  5);
+  c[0] ^= (t <<  2);
+}
+
+void gf_exp(gf out, const gf in, const uint64_t *exp)
+{
+  gf temp;
+
+  gf_copy(temp, in);
+  gf_set0(out);
+  out[0] = 1;
+  for (size_t i = 0; i < AIM2_NUM_WORDS_FIELD; i++)
+  {
+    uint64_t e = exp[i];
+    for (size_t j = 0; j < AIM2_NUM_BITS_WORD; j++, e >>= 1)
+    {
+      if (e & 1)
+      {
+        gf_mul(out, out, temp);
+      }
+      gf_sqr(temp, temp);
+    }
+  }
+}
+
+void gf_mat_vec_mul(gf c, const gf a, const gf b[AIM2_NUM_BITS_FIELD])
+{
+  const uint64_t *a_ptr = a;
+  const gf *b_ptr = b;
+
+  uint64_t temp_c0 = 0;
+  uint64_t temp_c1 = 0;
+  uint64_t temp_c2 = 0;
+  uint64_t temp_c3 = 0;
+  uint64_t mask;
+  for (size_t i = AIM2_NUM_WORDS_FIELD; i; --i, ++a_ptr)
+  {
+    uint64_t index = *a_ptr;
+    for (size_t j = AIM2_NUM_BITS_WORD; j; j -= 4, index >>= 4, b_ptr += 4)
+    {
+      mask = -(index & 1);
+      temp_c0 ^= (b_ptr[0][0] & mask);
+      temp_c1 ^= (b_ptr[0][1] & mask);
+      temp_c2 ^= (b_ptr[0][2] & mask);
+      temp_c3 ^= (b_ptr[0][3] & mask);
+
+      mask = -((index >> 1) & 1);
+      temp_c0 ^= (b_ptr[1][0] & mask);
+      temp_c1 ^= (b_ptr[1][1] & mask);
+      temp_c2 ^= (b_ptr[1][2] & mask);
+      temp_c3 ^= (b_ptr[1][3] & mask);
+
+      mask = -((index >> 2) & 1);
+      temp_c0 ^= (b_ptr[2][0] & mask);
+      temp_c1 ^= (b_ptr[2][1] & mask);
+      temp_c2 ^= (b_ptr[2][2] & mask);
+      temp_c3 ^= (b_ptr[2][3] & mask);
+
+      mask = -((index >> 3) & 1);
+      temp_c0 ^= (b_ptr[3][0] & mask);
+      temp_c1 ^= (b_ptr[3][1] & mask);
+      temp_c2 ^= (b_ptr[3][2] & mask);
+      temp_c3 ^= (b_ptr[3][3] & mask);
+    }
+  }
+  c[0] = temp_c0;
+  c[1] = temp_c1;
+  c[2] = temp_c2;
+  c[3] = temp_c3;
+}
+
+void gf_mat_vec_mul_add(gf c, const gf a, const gf b[AIM2_NUM_BITS_FIELD])
+{
+  const uint64_t *a_ptr = a;
+  const gf *b_ptr = b;
+
+  uint64_t temp_c0 = 0;
+  uint64_t temp_c1 = 0;
+  uint64_t temp_c2 = 0;
+  uint64_t temp_c3 = 0;
+  uint64_t mask;
+  for (size_t i = AIM2_NUM_WORDS_FIELD; i; --i, ++a_ptr)
+  {
+    uint64_t index = *a_ptr;
+    for (size_t j = AIM2_NUM_BITS_WORD; j; j -= 4, index >>= 4, b_ptr += 4)
+    {
+      mask = -(index & 1);
+      temp_c0 ^= (b_ptr[0][0] & mask);
+      temp_c1 ^= (b_ptr[0][1] & mask);
+      temp_c2 ^= (b_ptr[0][2] & mask);
+      temp_c3 ^= (b_ptr[0][3] & mask);
+
+      mask = -((index >> 1) & 1);
+      temp_c0 ^= (b_ptr[1][0] & mask);
+      temp_c1 ^= (b_ptr[1][1] & mask);
+      temp_c2 ^= (b_ptr[1][2] & mask);
+      temp_c3 ^= (b_ptr[1][3] & mask);
+
+      mask = -((index >> 2) & 1);
+      temp_c0 ^= (b_ptr[2][0] & mask);
+      temp_c1 ^= (b_ptr[2][1] & mask);
+      temp_c2 ^= (b_ptr[2][2] & mask);
+      temp_c3 ^= (b_ptr[2][3] & mask);
+
+      mask = -((index >> 3) & 1);
+      temp_c0 ^= (b_ptr[3][0] & mask);
+      temp_c1 ^= (b_ptr[3][1] & mask);
+      temp_c2 ^= (b_ptr[3][2] & mask);
+      temp_c3 ^= (b_ptr[3][3] & mask);
+    }
+  }
+  c[0] ^= temp_c0;
+  c[1] ^= temp_c1;
+  c[2] ^= temp_c2;
+  c[3] ^= temp_c3;
+}

data/vendor/AIMer/hash.c

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: MIT
+
+#include "hash.h"
+#include <stddef.h>
+#include <stdint.h>
+
+#if SECURITY_BITS == 128
+#define shake_inc_init shake128_inc_init
+#define shake_inc_absorb shake128_inc_absorb
+#define shake_inc_final shake128_inc_finalize
+#define shake_inc_squeeze shake128_inc_squeeze
+#define shake_inc_ctx_release shake128_inc_ctx_release
+#else
+#define shake_inc_init shake256_inc_init
+#define shake_inc_absorb shake256_inc_absorb
+#define shake_inc_final shake256_inc_finalize
+#define shake_inc_squeeze shake256_inc_squeeze
+#define shake_inc_ctx_release shake256_inc_ctx_release
+#endif
+
+void hash_init(hash_instance *ctx)
+{
+  shake_inc_init(ctx);
+}
+
+void hash_init_prefix(hash_instance *ctx, uint8_t prefix)
+{
+  shake_inc_init(ctx);
+  shake_inc_absorb(ctx, &prefix, sizeof(prefix));
+}
+
+void hash_update(hash_instance *ctx, const uint8_t *data, size_t data_len)
+{
+  shake_inc_absorb(ctx, data, data_len);
+}
+
+void hash_final(hash_instance *ctx)
+{
+  shake_inc_final(ctx);
+}
+
+void hash_squeeze(hash_instance *ctx, uint8_t *buffer, size_t buffer_len)
+{
+  shake_inc_squeeze(buffer, buffer_len, ctx);
+}
+
+void hash_ctx_release(hash_instance *ctx)
+{
+  shake_inc_ctx_release(ctx);
+}

data/vendor/AIMer/hash.h

@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HASH_H
+#define HASH_H
+
+#include "params.h"
+#include "common/fips202.h"
+#include <stddef.h>
+#include <stdint.h>
+
+static const uint8_t HASH_PREFIX_0 = (uint8_t)AIMER_HASH_PREFIX_0;
+static const uint8_t HASH_PREFIX_1 = 1;
+static const uint8_t HASH_PREFIX_2 = 2;
+static const uint8_t HASH_PREFIX_3 = 3;
+static const uint8_t HASH_PREFIX_4 = 4;
+static const uint8_t HASH_PREFIX_5 = 5;
+
+#if SECURITY_BITS == 128
+typedef shake128incctx hash_instance;
+#else
+typedef shake256incctx hash_instance;
+#endif
+
+#define hash_init AIMER_NAMESPACE(hash_init)
+void hash_init(hash_instance *ctx);
+#define hash_init_prefix AIMER_NAMESPACE(hash_init_prefix)
+void hash_init_prefix(hash_instance *ctx, uint8_t prefix);
+#define hash_update AIMER_NAMESPACE(hash_update)
+void hash_update(hash_instance *ctx, const uint8_t *data, size_t data_len);
+#define hash_final AIMER_NAMESPACE(hash_final)
+void hash_final(hash_instance *ctx);
+#define hash_squeeze AIMER_NAMESPACE(hash_squeeze)
+void hash_squeeze(hash_instance *ctx, uint8_t *buffer, size_t buffer_len);
+#define hash_ctx_release AIMER_NAMESPACE(hash_ctx_release)
+void hash_ctx_release(hash_instance *ctx);
+
+#endif // HASH_H

data/vendor/AIMer/params/params-aimer-128f.h

@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef PARAMS_H
+#define PARAMS_H
+
+#define AIMER_NAMESPACE(s)          samsungsds_aimer_128f_ref_##s
+
+#define SECURITY_BITS               128                  // security parameter
+#define SECURITY_BYTES              (SECURITY_BITS / 8)  // byte size of security parameter
+
+#define AIM2_NUM_BITS_FIELD         SECURITY_BITS        // number of bits in field element
+#define AIM2_NUM_BYTES_FIELD        SECURITY_BYTES       // number of bytes in field element
+#define AIM2_NUM_WORDS_FIELD        (SECURITY_BITS / 64) // number of 64-bit words in element
+#define AIM2_NUM_BITS_WORD          64                   // number of bits in word
+#define AIM2_IV_SIZE                SECURITY_BYTES       // byte size of AIM2 initial vector
+
+#define AIM2_NUM_INPUT_SBOX         2                    // number of AIM2 input S-boxes
+
+#define AIMER_SALT_SIZE             SECURITY_BYTES       // byte size of salt
+#define AIMER_SEED_SIZE             SECURITY_BYTES       // byte size of seed
+#define AIMER_COMMIT_SIZE           (SECURITY_BYTES * 2) // byte size of commitment
+
+#define AIMER_L                     AIM2_NUM_INPUT_SBOX
+#define AIMER_T                     33                   // number of parallel repetitions (Tau)
+#define AIMER_N                     16                   // number of MPC parties (N)
+#define AIMER_LOGN                  4                    // log_2(N)
+
+#define AIMER_PK_BYTES              32                   // byte size of public key
+#define AIMER_SK_BYTES              48                   // byte size of secret key
+#define AIMER_SIG_BYTES             5888                 // byte size of signature
+
+#define AIMER_HASH_PREFIX_0         0x00
+
+#endif // PARAMS_H