kpqc 0.1.0

data/vendor/AIMer/tree.c

@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: MIT
+
+#include "tree.h"
+#include "hash.h"
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+void expand_tree(uint8_t nodes[2 * AIMER_N - 1][AIMER_SEED_SIZE],
+                 const uint8_t salt[AIMER_SALT_SIZE], size_t rep_index,
+                 const uint8_t seed[AIMER_SEED_SIZE])
+{
+  size_t node_index;
+  hash_instance ctx;
+
+  memcpy(nodes[0], seed, AIMER_SEED_SIZE);
+  for (node_index = 1; node_index < AIMER_N; node_index++)
+  {
+    hash_init_prefix(&ctx, HASH_PREFIX_4);
+    hash_update(&ctx, salt, AIMER_SALT_SIZE);
+    hash_update(&ctx, (const uint8_t*)&rep_index, sizeof(uint8_t));
+    hash_update(&ctx, (const uint8_t*)&node_index, sizeof(uint8_t));
+    hash_update(&ctx, nodes[node_index - 1], AIMER_SEED_SIZE);
+    hash_final(&ctx);
+
+    hash_squeeze(&ctx, nodes[2 * node_index - 1], AIMER_SEED_SIZE << 1);
+    hash_ctx_release(&ctx);
+  }
+}
+
+void reveal_all_but(uint8_t reveal_path[AIMER_LOGN][AIMER_SEED_SIZE],
+                    const uint8_t nodes[2 * AIMER_N - 1][AIMER_SEED_SIZE],
+                    size_t cover_index)
+{
+  size_t index = cover_index + AIMER_N;
+  for (size_t depth = 0; depth < AIMER_LOGN; depth++)
+  {
+    // index ^ 1 is sibling index
+    memcpy(reveal_path[depth], nodes[(index ^ 1) - 1], AIMER_SEED_SIZE);
+
+    // go to parent node
+    index >>= 1;
+  }
+}
+
+void reconstruct_tree(uint8_t nodes[2 * AIMER_N - 2][AIMER_SEED_SIZE],
+                      const uint8_t salt[AIMER_SALT_SIZE],
+                      const uint8_t reveal_path[AIMER_LOGN][AIMER_SEED_SIZE],
+                      size_t rep_index, size_t cover_index)
+{
+  size_t index, depth, path;
+  hash_instance ctx;
+
+  for (depth = 1; depth < AIMER_LOGN; depth++)
+  {
+    path = ((cover_index + AIMER_N) >> (AIMER_LOGN - depth)) ^ 1;
+    memcpy(nodes[path - 2], reveal_path[AIMER_LOGN - depth], AIMER_SEED_SIZE);
+
+    for (index = (1U << depth); index < (2U << depth); index++)
+    {
+      hash_init_prefix(&ctx, HASH_PREFIX_4);
+      hash_update(&ctx, salt, AIMER_SALT_SIZE);
+      hash_update(&ctx, (const uint8_t*)&rep_index, sizeof(uint8_t));
+      hash_update(&ctx, (const uint8_t*)&index, sizeof(uint8_t));
+      hash_update(&ctx, nodes[index - 2], AIMER_SEED_SIZE);
+      hash_final(&ctx);
+
+      hash_squeeze(&ctx, nodes[2 * index - 2], AIMER_SEED_SIZE << 1);
+      hash_ctx_release(&ctx);
+    }
+  }
+
+  path = ((cover_index + AIMER_N) >> (AIMER_LOGN - depth)) ^ 1;
+  memcpy(nodes[path - 2], reveal_path[AIMER_LOGN - depth], AIMER_SEED_SIZE);
+}

data/vendor/AIMer/tree.h

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef TREE_H
+#define TREE_H
+
+#include "params.h"
+#include <stddef.h>
+#include <stdint.h>
+
+#define expand_tree AIMER_NAMESPACE(expand_trees)
+void expand_tree(uint8_t nodes[2 * AIMER_N - 1][AIMER_SEED_SIZE],
+                 const uint8_t salt[AIMER_SALT_SIZE], size_t rep_index,
+                 const uint8_t seed[AIMER_SEED_SIZE]);
+
+#define reveal_all_but AIMER_NAMESPACE(reveal_all_but)
+void reveal_all_but(uint8_t reveal_path[AIMER_LOGN][AIMER_SEED_SIZE],
+                    const uint8_t nodes[2 * AIMER_N - 1][AIMER_SEED_SIZE],
+                    size_t cover_index);
+
+#define reconstruct_tree AIMER_NAMESPACE(reconstruct_tree)
+void reconstruct_tree(uint8_t nodes[2 * AIMER_N - 2][AIMER_SEED_SIZE],
+                      const uint8_t salt[AIMER_SALT_SIZE],
+                      const uint8_t reveal_path[AIMER_LOGN][AIMER_SEED_SIZE],
+                      size_t rep_index, size_t cover_index);
+
+#endif // TREE_H

data/vendor/HAETAE/LICENSE

@@ -0,0 +1,22 @@
+Copyright (c) 2026 Team HAETAE
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.

data/vendor/HAETAE/include/api.h

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_API_H
+#define HAETAE_API_H
+
+#include "params.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define CRYPTO_ALGNAME HAETAE_CRYPTO_ALGNAME
+#define CRYPTO_SECRETKEYBYTES HAETAE_CRYPTO_SECRETKEYBYTES
+#define CRYPTO_PUBLICKEYBYTES HAETAE_CRYPTO_PUBLICKEYBYTES
+#define CRYPTO_BYTES HAETAE_CRYPTO_BYTES
+
+#define crypto_sign_keypair HAETAE_NAMESPACE(keypair)
+int crypto_sign_keypair(uint8_t *vk, uint8_t *sk);
+
+#define crypto_sign_keypair_internal HAETAE_NAMESPACE(keypair_internal)
+int crypto_sign_keypair_internal(uint8_t *vk, uint8_t *sk,
+                                 uint8_t seed[HAETAE_SEEDBYTES]);
+
+#define crypto_sign_signature_internal HAETAE_NAMESPACE(signature_internal)
+int crypto_sign_signature_internal(uint8_t *sig, size_t *siglen,
+                                   const uint8_t *m, size_t mlen,
+                                   const uint8_t *pre, size_t prelen,
+                                   const uint8_t rnd[HAETAE_SEEDBYTES],
+                                   const uint8_t *sk);
+
+#define crypto_sign_signature HAETAE_NAMESPACE(signature)
+int crypto_sign_signature(uint8_t *sig, size_t *siglen, const uint8_t *m,
+                          size_t mlen, const uint8_t *ctx, size_t ctxlen,
+                          const uint8_t *sk);
+
+#define crypto_sign HAETAE_NAMESPACE(sign)
+int crypto_sign(uint8_t *sm, size_t *smlen, const uint8_t *m, size_t mlen,
+                const uint8_t *ctx, size_t ctxlen, const uint8_t *sk);
+
+#define crypto_sign_verify_internal HAETAE_NAMESPACE(verify_internal)
+int crypto_sign_verify_internal(const uint8_t *sig, size_t siglen,
+                                const uint8_t *m, size_t mlen,
+                                const uint8_t *pre, size_t prelen,
+                                const uint8_t *vk);
+
+#define crypto_sign_verify HAETAE_NAMESPACE(verify)
+int crypto_sign_verify(const uint8_t *sig, size_t siglen, const uint8_t *m,
+                       size_t mlen, const uint8_t *ctx, size_t ctxlen,
+                       const uint8_t *vk);
+
+#define crypto_sign_open HAETAE_NAMESPACE(open)
+int crypto_sign_open(uint8_t *m, size_t *mlen, const uint8_t *sm, size_t smlen,
+                     const uint8_t *ctx, size_t ctxlen, const uint8_t *vk);
+
+#endif // HAETAE_API_H

data/vendor/HAETAE/include/common.h

@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_COMMON_H
+#define HAETAE_COMMON_H
+
+#define HAETAE_CONCAT_(x1, x2) x1##x2
+#define HAETAE_CONCAT(x1, x2) HAETAE_CONCAT_(x1, x2)
+
+#define HAETAE_STR_(x) #x
+#define HAETAE_STR(x) HAETAE_STR_(x)
+
+#endif /* !HAETAE_COMMON_H */

data/vendor/HAETAE/include/config.h

@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_CONFIG_H
+#define HAETAE_CONFIG_H
+
+#include "common.h"
+
+#define HAETAE_MODE2 0
+#define HAETAE_MODE3 1
+#define HAETAE_MODE5 2
+
+#if !defined(HAETAE_CONFIG_MODE)
+#define HAETAE_CONFIG_MODE HAETAE_MODE2
+#endif
+
+#if (HAETAE_CONFIG_MODE != HAETAE_MODE2) &&                                    \
+    (HAETAE_CONFIG_MODE != HAETAE_MODE3) &&                                    \
+    (HAETAE_CONFIG_MODE != HAETAE_MODE5)
+#error "Invalid HAETAE_CONFIG_MODE"
+#endif
+
+#if !defined(HAETAE_CONFIG_MODE_STRING)
+#if HAETAE_CONFIG_MODE == HAETAE_MODE2
+#define HAETAE_CONFIG_MODE_STRING mode2
+#elif HAETAE_CONFIG_MODE == HAETAE_MODE3
+#define HAETAE_CONFIG_MODE_STRING mode3
+#elif HAETAE_CONFIG_MODE == HAETAE_MODE5
+#define HAETAE_CONFIG_MODE_STRING mode5
+#endif
+#endif
+
+#if !defined(HAETAE_CONFIG_NAMESPACE_PREFIX)
+#define HAETAE_CONFIG_NAMESPACE_PREFIX cryptolab_haetae_
+#endif
+
+#if !defined(HAETAE_CONFIG_NAMESPACE_PREFIX_MODE)
+#define HAETAE_ADD_MODE(s) HAETAE_CONCAT(s, HAETAE_CONFIG_MODE_STRING)
+#define HAETAE_CONFIG_NAMESPACE_PREFIX_MODE                                    \
+  HAETAE_CONCAT(HAETAE_ADD_MODE(HAETAE_CONFIG_NAMESPACE_PREFIX), _)
+#endif
+
+#endif /* !HAETAE_CONFIG_H */

data/vendor/HAETAE/include/decompose.h

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_DECOMPOSE_H
+#define HAETAE_DECOMPOSE_H
+
+#include "params.h"
+
+#include <stdint.h>
+
+#define decompose_z1 HAETAE_NAMESPACE(decompose_z1)
+void decompose_z1(int32_t *highbits, int32_t *lowbits, const int32_t r);
+
+#define decompose_hint HAETAE_NAMESPACE(decompose_hint)
+void decompose_hint(int32_t *highbits, const int32_t r);
+
+#define decompose_vk HAETAE_NAMESPACE(decompose_vk)
+int32_t decompose_vk(int32_t *a0, const int32_t a);
+
+#endif /* !HAETAE_DECOMPOSE_H */

data/vendor/HAETAE/include/encoding.h

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_ENCODING_H
+#define HAETAE_ENCODING_H
+
+#include "params.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define encode_h HAETAE_NAMESPACE(encode_h)
+uint16_t encode_h(uint8_t *buf, const int32_t *h);
+#define decode_h HAETAE_NAMESPACE(decode_h)
+uint16_t decode_h(int32_t *h, const uint8_t *buf, uint16_t size_in);
+#define encode_hb_z1 HAETAE_NAMESPACE(encode_hb_z1)
+uint16_t encode_hb_z1(uint8_t *buf, const int32_t *hb_z1);
+#define decode_hb_z1 HAETAE_NAMESPACE(decode_hb_z1)
+uint16_t decode_hb_z1(int32_t *hb_z1, const uint8_t *buf, uint16_t size_in);
+
+#endif /* !HAETAE_ENCODING_H */

data/vendor/HAETAE/include/fft.h

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_FFT_H
+#define HAETAE_FFT_H
+
+#include "params.h"
+#include "poly.h"
+
+#include <stdint.h>
+
+#define FFT_N 256
+#define FFT_LOGN 8
+
+typedef struct {
+  int32_t real;
+  int32_t imag;
+} complex_fp32_16;
+
+#define fft HAETAE_NAMESPACE(fft)
+void fft(complex_fp32_16 data[FFT_N]);
+#define fft_init_and_bitrev HAETAE_NAMESPACE(fft_init_and_bitrev)
+void fft_init_and_bitrev(complex_fp32_16 r[FFT_N], const poly *x);
+#define complex_fp_sqabs HAETAE_NAMESPACE(complex_fp_sqabs)
+int32_t complex_fp_sqabs(complex_fp32_16 x);
+
+#endif /* !HAETAE_FFT_H */

data/vendor/HAETAE/include/fips202.h

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_FIPS202_H
+#define HAETAE_FIPS202_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define SHAKE128_RATE 168
+#define SHAKE256_RATE 136
+#define SHA3_256_RATE 136
+#define SHA3_512_RATE 72
+
+typedef struct {
+  uint64_t s[25];
+  unsigned int pos;
+} keccak_state;
+
+extern const uint64_t KeccakF_RoundConstants[];
+
+void shake128_init(keccak_state *state);
+void shake128_absorb(keccak_state *state, const uint8_t *in, size_t inlen);
+void shake128_finalize(keccak_state *state);
+void shake128_squeeze(uint8_t *out, size_t outlen, keccak_state *state);
+void shake128_absorb_once(keccak_state *state, const uint8_t *in, size_t inlen);
+void shake128_squeezeblocks(uint8_t *out, size_t nblocks, keccak_state *state);
+
+void shake256_init(keccak_state *state);
+void shake256_absorb(keccak_state *state, const uint8_t *in, size_t inlen);
+void shake256_finalize(keccak_state *state);
+void shake256_squeeze(uint8_t *out, size_t outlen, keccak_state *state);
+void shake256_absorb_once(keccak_state *state, const uint8_t *in, size_t inlen);
+void shake256_squeezeblocks(uint8_t *out, size_t nblocks, keccak_state *state);
+
+void shake128(uint8_t *out, size_t outlen, const uint8_t *in, size_t inlen);
+void shake256(uint8_t *out, size_t outlen, const uint8_t *in, size_t inlen);
+void sha3_256(uint8_t h[32], const uint8_t *in, size_t inlen);
+void sha3_512(uint8_t h[64], const uint8_t *in, size_t inlen);
+
+#endif /* !HAETAE_FIPS202_H */

data/vendor/HAETAE/include/fixpoint.h

@@ -0,0 +1,125 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_FIXPOINT_H
+#define HAETAE_FIXPOINT_H
+
+#include "params.h"
+
+#include <stdint.h>
+#include <stdlib.h>
+
+#ifdef __SIZEOF_INT128__
+__extension__ typedef __int128 int128;
+__extension__ typedef unsigned __int128 uint128;
+#endif
+
+typedef struct {
+  uint64_t limb48[2];
+} fp96_76;
+
+#define fixpoint_square HAETAE_NAMESPACE(fixpoint_square)
+void fixpoint_square(fp96_76 *sqx, const fp96_76 *x);
+
+#define fixpoint_newton_invsqrt HAETAE_NAMESPACE(fixpoint_newton_invsqrt)
+void fixpoint_newton_invsqrt(fp96_76 *invsqrtx, const fp96_76 *xhalf);
+
+#define fixpoint_mul_rnd13 HAETAE_NAMESPACE(fixpoint_mul_rnd13)
+int32_t fixpoint_mul_rnd13(const uint64_t x, const fp96_76 *y,
+                           const uint8_t sign);
+
+#define fixpoint_add HAETAE_NAMESPACE(fixpoint_add)
+void fixpoint_add(fp96_76 *xy, const fp96_76 *x, const fp96_76 *y);
+
+static inline void renormalize(fp96_76 *x) {
+  x->limb48[1] += x->limb48[0] >> 48;
+  x->limb48[0] &= (1ULL << 48) - 1;
+}
+
+static inline int64_t smulh48(int64_t a, uint64_t b) {
+#ifndef __SIZEOF_INT128__
+  int64_t ah = a >> 24;
+  int64_t al = a - (ah << 24);
+  int64_t bl = b & ((1 << 24) - 1);
+  int64_t bh = b >> 24;
+
+  int64_t res = (al * bl) >> 24;
+  res += al * bh + ah * bl + (1 << 23); // rounding
+  res >>= 24;
+  return res + (ah * bh);
+#else
+  return ((int128)a * (int128)b + (1ULL << 47)) >> 48; // rounding
+#endif
+}
+
+static inline void mul64(uint64_t r[2], const uint64_t b, const uint64_t a) {
+#ifndef __SIZEOF_INT128__
+  uint64_t al = a & ((1ULL << 32) - 1), bl = b & ((1ULL << 32) - 1),
+           ah = a >> 32, bh = b >> 32;
+  r[0] = a * b;
+  r[1] = ah * bl + al * bh + ((al * bl) >> 32);
+  r[1] >>= 32;
+  r[1] += ah * bh;
+#else
+  uint128 res = ((uint128)a * (uint128)b);
+  r[0] = res;
+  r[1] = res >> 64;
+#endif
+}
+
+static inline void sq64(uint64_t r[2], const uint64_t a) {
+#ifndef __SIZEOF_INT128__
+  uint64_t al = a & ((1ULL << 32) - 1), ah = a >> 32;
+  r[0] = a * a;
+  r[1] = ah * al * 2 + ((al * al) >> 32);
+  r[1] >>= 32;
+  r[1] += ah * ah;
+#else
+  uint128 res = ((uint128)a * (uint128)a);
+  r[0] = res;
+  r[1] = res >> 64;
+#endif
+}
+
+static inline void mul48(uint64_t r[2], const uint64_t b, const uint64_t a) {
+  mul64(r, b, a);
+  r[1] <<= 16;
+  r[1] ^= r[0] >> 48;
+  r[0] &= (1ULL << 48) - 1;
+}
+
+static inline void mulacc48(uint64_t r[2], const uint64_t b, const uint64_t a) {
+  uint64_t tmp[2];
+  mul48(tmp, b, a);
+  r[0] += tmp[0];
+  r[1] += tmp[1];
+}
+
+// (a0 + a1*2^32)^2 = a0^2 + 2^33*a0*a1 + 2^64*a1^2
+static inline void sq48(uint64_t r[2], const uint64_t a) {
+  sq64(r, a);
+
+  r[1] <<= 16;
+  r[1] ^= r[0] >> 48;
+  r[0] &= (1ULL << 48) - 1;
+}
+
+static inline void fixpoint_mul_high(fp96_76 *xy, const fp96_76 *x,
+                                     const uint64_t y) {
+  uint64_t tmp[2];
+  mul48(&xy->limb48[0], x->limb48[0], y); // implicitly shifted right by 48
+
+  mul48(tmp, x->limb48[1], y);
+  xy->limb48[1] += tmp[0];
+
+  // shift right by 28, rounding
+  xy->limb48[0] += 1UL << 27;
+  xy->limb48[0] >>= 28;
+  xy->limb48[0] += (xy->limb48[1] << 20) & ((1ULL << 48) - 1);
+  xy->limb48[1] >>= 28;
+
+  xy->limb48[1] += tmp[1] << 20;
+
+  renormalize(xy);
+}
+
+#endif /* !HAETAE_FIXPOINT_H */

data/vendor/HAETAE/include/ntt.h

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_NTT_H
+#define HAETAE_NTT_H
+
+#include "params.h"
+
+#include <stdint.h>
+
+#define ntt HAETAE_NAMESPACE(ntt)
+void ntt(int32_t a[HAETAE_N]);
+
+#define invntt_tomont HAETAE_NAMESPACE(invntt_tomont)
+void invntt_tomont(int32_t a[HAETAE_N]);
+
+#endif /* !HAETAE_NTT_H */

data/vendor/HAETAE/include/packing.h

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_PACKING_H
+#define HAETAE_PACKING_H
+
+#include "params.h"
+#include "polyvec.h"
+
+#include <stdint.h>
+
+#define pack_vk HAETAE_NAMESPACE(pack_vk)
+void pack_vk(uint8_t vk[HAETAE_CRYPTO_PUBLICKEYBYTES], polyveck *b,
+             const uint8_t seed[HAETAE_SEEDBYTES]);
+#define unpack_vk HAETAE_NAMESPACE(unpack_vk)
+void unpack_vk(polyvecl A[HAETAE_K],
+               const uint8_t vk[HAETAE_CRYPTO_PUBLICKEYBYTES]);
+
+#define pack_sk HAETAE_NAMESPACE(pack_sk)
+void pack_sk(uint8_t sk[HAETAE_CRYPTO_SECRETKEYBYTES],
+             const uint8_t vk[HAETAE_CRYPTO_PUBLICKEYBYTES], const polyvecm *s0,
+             const polyveck *s1, const uint8_t key[HAETAE_SEEDBYTES]);
+#define unpack_sk HAETAE_NAMESPACE(unpack_sk)
+void unpack_sk(polyvecl A[HAETAE_K], polyvecm *s0, polyveck *s1, uint8_t *key,
+               const uint8_t sk[HAETAE_CRYPTO_SECRETKEYBYTES]);
+
+#define pack_sig HAETAE_NAMESPACE(pack_sig)
+int pack_sig(uint8_t sig[HAETAE_CRYPTO_BYTES], const poly *c,
+             const polyvecl *lowbits_z1, const polyvecl *highbits_z1,
+             const polyveck *h);
+#define unpack_sig HAETAE_NAMESPACE(unpack_sig)
+int unpack_sig(poly *c, polyvecl *lowbits_z1, polyvecl *highbits_z1,
+               polyveck *h, const uint8_t sig[HAETAE_CRYPTO_BYTES]);
+
+#define pack_poly_q HAETAE_NAMESPACE(pack_poly_q)
+void pack_poly_q(uint8_t *r, const poly *a);
+#define unpack_poly_q HAETAE_NAMESPACE(unpack_poly_q)
+void unpack_poly_q(poly *r, const uint8_t *a);
+
+#define pack_poly_eta HAETAE_NAMESPACE(pack_poly_eta)
+void pack_poly_eta(uint8_t *r, const poly *a);
+#define unpack_poly_eta HAETAE_NAMESPACE(unpack_poly_eta)
+void unpack_poly_eta(poly *r, const uint8_t *a);
+
+#define pack_poly2_eta HAETAE_NAMESPACE(pack_poly2_eta)
+void pack_poly2_eta(uint8_t *r, const poly *a);
+#define unpack_poly2_eta HAETAE_NAMESPACE(unpack_poly2_eta)
+void unpack_poly2_eta(poly *r, const uint8_t *a);
+
+#define pack_vec_highbits HAETAE_NAMESPACE(pack_vec_highbits)
+void pack_vec_highbits(uint8_t *buf, const polyveck *v);
+
+#define pack_poly_highbits HAETAE_NAMESPACE(pack_poly_highbits)
+void pack_poly_highbits(uint8_t *buf, const poly *a);
+
+#define pack_poly_lsb HAETAE_NAMESPACE(pack_poly_lsb)
+void pack_poly_lsb(uint8_t *buf, const poly *a);
+
+#endif /* !HAETAE_PACKING_H */

data/vendor/HAETAE/include/params.h

@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_PARAMS_H
+#define HAETAE_PARAMS_H
+
+#include "config.h"
+
+#define HAETAE_SEEDBYTES 32
+#define HAETAE_CRHBYTES 64
+#define HAETAE_N 256
+
+#define HAETAE_Q 64513
+#define HAETAE_DQ (HAETAE_Q << 1) // 2Q
+
+#define HAETAE_MODE HAETAE_CONFIG_MODE
+#define HAETAE_NAMESPACE(s)                                                    \
+  HAETAE_CONCAT(HAETAE_CONFIG_NAMESPACE_PREFIX_MODE, s)
+#define HAETAE_CRYPTO_ALGNAME                                                  \
+  HAETAE_STR(HAETAE_CONCAT(haetae_, HAETAE_CONFIG_MODE_STRING))
+
+#if HAETAE_MODE == HAETAE_MODE2
+#define HAETAE_K 2
+#define HAETAE_L 4
+#define HAETAE_TAU 58
+#define HAETAE_B0 9846.02
+#define HAETAE_B1 9838.98
+#define HAETAE_B2 12777.52
+#define HAETAE_GAMMA 48.858
+#define HAETAE_LN 8192 // Large N
+#define HAETAE_LNHALF 4096
+#define HAETAE_LNBITS 13
+#define HAETAE_SQNM 39.191835884530846 // \sqrt(n * m)
+#define HAETAE_CRYPTO_BYTES 1474
+
+#define HAETAE_BASE_ENC_HB_Z1 132
+#define HAETAE_BASE_ENC_H 7
+
+#define HAETAE_ALPHA_HINT 512
+#define HAETAE_LOG_ALPHA_HINT 9
+
+#define HAETAE_POLYQ_PACKEDBYTES 480 // 16bits * HAETAE_N / 8bits
+
+#elif HAETAE_MODE == HAETAE_MODE3
+#define HAETAE_K 3
+#define HAETAE_L 6
+#define HAETAE_TAU 80
+#define HAETAE_B0 18314.98
+#define HAETAE_B1 18307.70
+#define HAETAE_B2 21906.65
+#define HAETAE_GAMMA 57.707
+#define HAETAE_LN 8192 // Large N
+#define HAETAE_LNHALF 4096
+#define HAETAE_LNBITS 13
+#define HAETAE_SQNM 48.0
+#define HAETAE_CRYPTO_BYTES 2349
+
+#define HAETAE_BASE_ENC_HB_Z1 376
+#define HAETAE_BASE_ENC_H 127
+
+#define HAETAE_ALPHA_HINT 512
+#define HAETAE_LOG_ALPHA_HINT 9
+
+#define HAETAE_POLYQ_PACKEDBYTES 480 // 16bits * HAETAE_N / 8bits
+
+#elif HAETAE_MODE == HAETAE_MODE5
+#define HAETAE_K 4
+#define HAETAE_L 7
+#define HAETAE_TAU 128
+#define HAETAE_B0 22343.66
+#define HAETAE_B1 22334.95
+#define HAETAE_B2 24441.49
+#define HAETAE_GAMMA 55.13
+#define HAETAE_LN 8192 // Large N
+#define HAETAE_LNHALF 4096
+#define HAETAE_LNBITS 13
+#define HAETAE_SQNM 53.0659966456864
+#define HAETAE_CRYPTO_BYTES 2948
+
+#define HAETAE_BASE_ENC_HB_Z1 501
+#define HAETAE_BASE_ENC_H 358
+
+#define HAETAE_ALPHA_HINT 256
+#define HAETAE_LOG_ALPHA_HINT 8
+
+#define HAETAE_POLYQ_PACKEDBYTES 512 // 16bits * HAETAE_N / 8bits
+
+#endif // HAETAE_MODE
+
+#define HAETAE_HALF_ALPHA_HINT (HAETAE_ALPHA_HINT >> 1) // ALPHA / 2
+
+#define HAETAE_B0SQ ((uint64_t)(HAETAE_B0 * HAETAE_B0))
+#define HAETAE_B1SQ ((uint64_t)(HAETAE_B1 * HAETAE_B1))
+#define HAETAE_B2SQ ((uint64_t)(HAETAE_B2 * HAETAE_B2))
+
+#define HAETAE_M (HAETAE_L - 1)
+
+#define HAETAE_ETA 1
+#define HAETAE_POLYETA_PACKEDBYTES 64
+#if (HAETAE_MODE == HAETAE_MODE2) || (HAETAE_MODE == HAETAE_MODE3)
+#define HAETAE_POLY2ETA_PACKEDBYTES 96
+#elif HAETAE_MODE == HAETAE_MODE5
+#define HAETAE_POLY2ETA_PACKEDBYTES 64
+#endif
+
+#define HAETAE_POLYC_PACKEDBYTES 32 // 1bit * HAETAE_N / 8bits
+#define HAETAE_POLY_HIGHBITS_PACKEDBYTES (HAETAE_N * 9 / 8)
+#define HAETAE_POLYVECK_HIGHBITS_PACKEDBYTES                                   \
+  (HAETAE_POLY_HIGHBITS_PACKEDBYTES * HAETAE_K)
+
+#define HAETAE_CRYPTO_PUBLICKEYBYTES                                           \
+  (HAETAE_SEEDBYTES + HAETAE_K * HAETAE_POLYQ_PACKEDBYTES) // seed + b
+#define HAETAE_CRYPTO_SECRETKEYBYTES                                           \
+  (HAETAE_CRYPTO_PUBLICKEYBYTES + HAETAE_M * HAETAE_POLYETA_PACKEDBYTES +      \
+   HAETAE_K * HAETAE_POLY2ETA_PACKEDBYTES +                                    \
+   HAETAE_SEEDBYTES) // vk + s + HAETAE_K
+
+#endif /* !HAETAE_PARAMS_H */