kpqc 0.1.0

data/vendor/HAETAE/include/poly.h

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_POLY_H
+#define HAETAE_POLY_H
+
+#include "params.h"
+
+#include <stdint.h>
+
+typedef struct {
+  int32_t coeffs[HAETAE_N];
+} poly;
+
+#define poly_add HAETAE_NAMESPACE(poly_add)
+void poly_add(poly *c, const poly *a, const poly *b);
+#define poly_sub HAETAE_NAMESPACE(poly_sub)
+void poly_sub(poly *c, const poly *a, const poly *b);
+#define poly_pointwise_montgomery HAETAE_NAMESPACE(poly_pointwise_montgomery)
+void poly_pointwise_montgomery(poly *c, const poly *a, const poly *b);
+
+#define poly_reduce2q HAETAE_NAMESPACE(poly_reduce2q)
+void poly_reduce2q(poly *a);
+#define poly_freeze2q HAETAE_NAMESPACE(poly_freeze2q)
+void poly_freeze2q(poly *a);
+#define poly_freeze HAETAE_NAMESPACE(poly_freeze)
+void poly_freeze(poly *a);
+
+#define poly_highbits HAETAE_NAMESPACE(poly_highbits)
+void poly_highbits(poly *a2, const poly *a);
+#define poly_lowbits HAETAE_NAMESPACE(poly_lowbits)
+void poly_lowbits(poly *a1, const poly *a);
+#define poly_compose HAETAE_NAMESPACE(poly_compose)
+void poly_compose(poly *a, const poly *ha, const poly *la);
+#define poly_lsb HAETAE_NAMESPACE(poly_lsb)
+void poly_lsb(poly *a0, const poly *a);
+
+#define poly_uniform HAETAE_NAMESPACE(poly_uniform)
+void poly_uniform(poly *a, const uint8_t seed[HAETAE_SEEDBYTES],
+                  uint16_t nonce);
+#define poly_uniform_eta HAETAE_NAMESPACE(poly_uniform_eta)
+void poly_uniform_eta(poly *a, const uint8_t seed[HAETAE_CRHBYTES],
+                      uint16_t nonce);
+#define poly_challenge HAETAE_NAMESPACE(poly_challenge)
+void poly_challenge(
+    poly *c,
+    const uint8_t highbits_lsb[HAETAE_POLYVECK_HIGHBITS_PACKEDBYTES +
+                               HAETAE_POLYC_PACKEDBYTES],
+    const uint8_t mu[HAETAE_SEEDBYTES]);
+
+#define poly_decomposed_pack HAETAE_NAMESPACE(poly_decomposed_pack)
+void poly_decomposed_pack(uint8_t *buf, const poly *a);
+#define poly_decomposed_unpack HAETAE_NAMESPACE(poly_decomposed_unpack)
+void poly_decomposed_unpack(poly *a, const uint8_t *buf);
+
+#define poly_fromcrt HAETAE_NAMESPACE(poly_fromcrt)
+void poly_fromcrt(poly *w, const poly *u, const poly *v);
+#define poly_fromcrt0 HAETAE_NAMESPACE(poly_fromcrt0)
+void poly_fromcrt0(poly *w, const poly *u);
+
+#define poly_ntt HAETAE_NAMESPACE(poly_ntt)
+void poly_ntt(poly *a);
+#define poly_invntt_tomont HAETAE_NAMESPACE(poly_invntt_tomont)
+void poly_invntt_tomont(poly *a);
+
+#endif /* !HAETAE_POLY_H */

data/vendor/HAETAE/include/polyfix.h

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_POLYFIX_H
+#define HAETAE_POLYFIX_H
+
+#include "params.h"
+#include "poly.h"
+#include "polyvec.h"
+
+#include <stdint.h>
+
+typedef struct {
+  int32_t coeffs[HAETAE_N];
+} polyfix;
+
+#define polyfix_norm2 HAETAE_NAMESPACE(polyfix_norm2)
+double polyfix_norm2(const polyfix *a);
+
+#define polyfix_round HAETAE_NAMESPACE(polyfix_round)
+void polyfix_round(poly *a, const polyfix *b);
+
+#define polyfix_add HAETAE_NAMESPACE(polyfix_add)
+void polyfix_add(polyfix *c, const polyfix *a, const poly *b);
+
+typedef struct {
+  polyfix vec[HAETAE_K];
+} polyfixveck;
+
+#define polyfixveck_add HAETAE_NAMESPACE(polyfixveck_add)
+void polyfixveck_add(polyfixveck *w, const polyfixveck *u, const polyveck *v);
+#define polyfixfixveck_sub HAETAE_NAMESPACE(polyfixfixveck_sub)
+void polyfixfixveck_sub(polyfixveck *w, const polyfixveck *u,
+                        const polyfixveck *v);
+#define polyfixveck_double HAETAE_NAMESPACE(polyfixveck_double)
+void polyfixveck_double(polyfixveck *b, const polyfixveck *a);
+
+#define polyfixveck_round HAETAE_NAMESPACE(polyfixveck_round)
+void polyfixveck_round(polyveck *a, const polyfixveck *b);
+
+typedef struct {
+  polyfix vec[HAETAE_L];
+} polyfixvecl;
+
+#define polyfixvecl_add HAETAE_NAMESPACE(polyfixvecl_add)
+void polyfixvecl_add(polyfixvecl *w, const polyfixvecl *u, const polyvecl *v);
+#define polyfixfixvecl_sub HAETAE_NAMESPACE(polyfixfixvecl_sub)
+void polyfixfixvecl_sub(polyfixvecl *w, const polyfixvecl *u,
+                        const polyfixvecl *v);
+#define polyfixvecl_double HAETAE_NAMESPACE(polyfixvecl_double)
+void polyfixvecl_double(polyfixvecl *b, const polyfixvecl *a);
+
+#define polyfixvecl_round HAETAE_NAMESPACE(polyfixvecl_round)
+void polyfixvecl_round(polyvecl *a, const polyfixvecl *b);
+
+#define polyfixveclk_sqnorm2 HAETAE_NAMESPACE(polyfixveclk_sqnorm2)
+uint64_t polyfixveclk_sqnorm2(const polyfixvecl *a, const polyfixveck *b);
+
+#define polyfixveclk_sample_hyperball                                          \
+  HAETAE_NAMESPACE(polyfixveclk_sample_hyperball)
+uint16_t polyfixveclk_sample_hyperball(polyfixvecl *y1, polyfixveck *y2,
+                                       uint8_t *b,
+                                       const uint8_t seed[HAETAE_CRHBYTES],
+                                       const uint16_t nonce);
+
+#endif /* !HAETAE_POLYFIX_H */

data/vendor/HAETAE/include/polymat.h

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_POLYMAT_H
+#define HAETAE_POLYMAT_H
+
+#include "params.h"
+#include "polyvec.h"
+
+#include <stdint.h>
+
+#define polymatkl_expand_matA HAETAE_NAMESPACE(polymatkl_expand_matA)
+void polymatkl_expand_matA(polyvecl mat[HAETAE_K],
+                           const uint8_t rho[HAETAE_SEEDBYTES]);
+
+#define polymatkm_expand_matA HAETAE_NAMESPACE(polymatkm_expand_matA)
+void polymatkm_expand_matA(polyvecm mat[HAETAE_K],
+                           const uint8_t rho[HAETAE_SEEDBYTES]);
+
+#define polymatkm_pointwise_montgomery                                         \
+  HAETAE_NAMESPACE(polymatkm_pointwise_montgomery)
+void polymatkm_pointwise_montgomery(polyveck *t, const polyvecm mat[HAETAE_K],
+                                    const polyvecm *v);
+
+#define polymatkl_pointwise_montgomery                                         \
+  HAETAE_NAMESPACE(polymatkl_pointwise_montgomery)
+void polymatkl_pointwise_montgomery(polyveck *t, const polyvecl mat[HAETAE_K],
+                                    const polyvecl *v);
+
+#define polymatkl_double HAETAE_NAMESPACE(polymatkl_double)
+void polymatkl_double(polyvecl mat[HAETAE_K]);
+
+#endif /* !HAETAE_POLYMAT_H */

data/vendor/HAETAE/include/polyvec.h

@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_POLYVEC_H
+#define HAETAE_POLYVEC_H
+
+#include "params.h"
+#include "poly.h"
+
+#include <stdint.h>
+
+/* Vectors of polynomials of length HAETAE_K */
+typedef struct {
+  poly vec[HAETAE_K];
+} polyveck;
+
+#define polyveck_add HAETAE_NAMESPACE(polyveck_add)
+void polyveck_add(polyveck *w, const polyveck *u, const polyveck *v);
+#define polyveck_sub HAETAE_NAMESPACE(polyveck_sub)
+void polyveck_sub(polyveck *w, const polyveck *u, const polyveck *v);
+#define polyveck_double HAETAE_NAMESPACE(polyveck_double)
+void polyveck_double(polyveck *b);
+
+#define polyveck_reduce2q HAETAE_NAMESPACE(polyveck_reduce2q)
+void polyveck_reduce2q(polyveck *v);
+#define polyveck_freeze2q HAETAE_NAMESPACE(polyveck_freeze2q)
+void polyveck_freeze2q(polyveck *v);
+#define polyveck_freeze HAETAE_NAMESPACE(polyveck_freeze)
+void polyveck_freeze(polyveck *v);
+
+#define polyveck_uniform_eta HAETAE_NAMESPACE(polyveck_uniform_eta)
+void polyveck_uniform_eta(polyveck *v, const uint8_t seed[HAETAE_CRHBYTES],
+                          uint16_t nonce);
+#define polyveck_expand_vecA HAETAE_NAMESPACE(polyveck_expand_vecA)
+void polyveck_expand_vecA(polyveck *v, const uint8_t seed[HAETAE_SEEDBYTES]);
+
+#define polyveck_ntt HAETAE_NAMESPACE(polyveck_ntt)
+void polyveck_ntt(polyveck *x);
+
+#define polyveck_invntt_tomont HAETAE_NAMESPACE(polyveck_invntt_tomont)
+void polyveck_invntt_tomont(polyveck *x);
+
+#define polyveck_double_negate HAETAE_NAMESPACE(polyveck_double_negate)
+void polyveck_double_negate(polyveck *x);
+
+#define polyveck_frommont HAETAE_NAMESPACE(polyveck_frommont)
+void polyveck_frommont(polyveck *x);
+
+#define polyveck_poly_pointwise_montgomery                                     \
+  HAETAE_NAMESPACE(polyveck_poly_pointwise_montgomery)
+void polyveck_poly_pointwise_montgomery(polyveck *w, const polyveck *u,
+                                        const poly *v);
+
+#define polyveck_poly_fromcrt HAETAE_NAMESPACE(polyveck_poly_fromcrt)
+void polyveck_poly_fromcrt(polyveck *w, const polyveck *u, const poly *v);
+
+#define polyveck_highbits_hint HAETAE_NAMESPACE(polyveck_highbits_hint)
+void polyveck_highbits_hint(polyveck *w, const polyveck *v);
+
+#define polyveck_cneg HAETAE_NAMESPACE(polyveck_cneg)
+void polyveck_cneg(polyveck *v, const uint8_t b);
+
+#define polyveck_caddDQ2ALPHA HAETAE_NAMESPACE(polyveck_caddDQ2ALPHA)
+void polyveck_caddDQ2ALPHA(polyveck *h);
+
+#define polyveck_csubDQ2ALPHA HAETAE_NAMESPACE(polyveck_csubDQ2ALPHA)
+void polyveck_csubDQ2ALPHA(polyveck *v);
+
+#define polyveck_mul_alpha HAETAE_NAMESPACE(polyveck_mul_alpha)
+void polyveck_mul_alpha(polyveck *v, const polyveck *u);
+
+#define polyveck_div2 HAETAE_NAMESPACE(polyveck_div2)
+void polyveck_div2(polyveck *v);
+
+#define polyveck_caddq HAETAE_NAMESPACE(polyveck_caddq)
+void polyveck_caddq(polyveck *v);
+
+#define polyveck_decompose_vk HAETAE_NAMESPACE(polyveck_decompose_vk)
+void polyveck_decompose_vk(polyveck *v0, polyveck *v);
+
+#define polyveck_sqnorm2 HAETAE_NAMESPACE(polyveck_sqnorm2)
+uint64_t polyveck_sqnorm2(const polyveck *b);
+
+/* Vectors of polynomials of length L */
+typedef struct {
+  poly vec[HAETAE_L];
+} polyvecl;
+
+#define polyvecl_cneg HAETAE_NAMESPACE(polyvecl_cneg)
+void polyvecl_cneg(polyvecl *v, const uint8_t b);
+
+#define polyvecl_sqnorm2 HAETAE_NAMESPACE(polyvecl_sqnorm2)
+uint64_t polyvecl_sqnorm2(const polyvecl *a);
+
+#define polyvecl_ntt HAETAE_NAMESPACE(polyvecl_ntt)
+void polyvecl_ntt(polyvecl *x);
+
+#define polyvecl_highbits HAETAE_NAMESPACE(polyvecl_highbits)
+void polyvecl_highbits(polyvecl *v2, const polyvecl *v);
+#define polyvecl_lowbits HAETAE_NAMESPACE(polyvecl_lowbits)
+void polyvecl_lowbits(polyvecl *v2, const polyvecl *v);
+
+#define polyvecl_pointwise_acc_montgomery                                      \
+  HAETAE_NAMESPACE(polyvecl_pointwise_acc_montgomery)
+void polyvecl_pointwise_acc_montgomery(poly *w, const polyvecl *u,
+                                       const polyvecl *v);
+
+/* Vectors of polynomials of length M */
+typedef struct {
+  poly vec[HAETAE_M];
+} polyvecm;
+
+#define polyvecm_ntt HAETAE_NAMESPACE(polyvecm_ntt)
+void polyvecm_ntt(polyvecm *x);
+
+#define polyvecmk_expand_S HAETAE_NAMESPACE(polyvecmk_expand_S)
+void polyvecmk_expand_S(polyvecm *u, polyveck *v,
+                        const uint8_t seed[HAETAE_CRHBYTES], uint16_t nonce);
+
+#define polyvecm_pointwise_acc_montgomery                                      \
+  HAETAE_NAMESPACE(polyvecm_pointwise_acc_montgomery)
+void polyvecm_pointwise_acc_montgomery(poly *w, const polyvecm *u,
+                                       const polyvecm *v);
+
+#define polyvecmk_sk_singular_value                                            \
+  HAETAE_NAMESPACE(polyvecmk_sk_singular_value)
+int64_t polyvecmk_sk_singular_value(const polyvecm *s1, const polyveck *s2);
+
+#define polyvecmk_sing_value HAETAE_NAMESPACE(polyvecmk_sing_value)
+int64_t polyvecmk_sing_value(const polyvecm *s1, const polyveck *s2);
+
+#endif /* !HAETAE_POLYVEC_H */

data/vendor/HAETAE/include/randombytes.h

@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_RANDOMBYTES_H
+#define HAETAE_RANDOMBYTES_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define RNG_SUCCESS 0
+#define RNG_BAD_MAXLEN -1
+#define RNG_BAD_OUTBUF -2
+#define RNG_BAD_REQ_LEN -3
+#define RNG_FAIL_SYSCALL -4
+
+typedef struct {
+  unsigned char buffer[16];
+  int buffer_pos;
+  unsigned long length_remaining;
+  unsigned char key[32];
+  unsigned char ctr[16];
+} AES_XOF_struct;
+
+typedef struct {
+  unsigned char Key[32];
+  unsigned char V[16];
+  int reseed_counter;
+  int init;
+} AES256_CTR_DRBG_struct;
+
+void AES256_CTR_DRBG_Update(unsigned char *provided_data, unsigned char *Key,
+                            unsigned char *V);
+
+void randombytes_init(unsigned char *entropy_input,
+                      unsigned char *personalization_string,
+                      int security_strength);
+
+int randombytes(uint8_t *out, size_t outlen);
+
+#endif /* !HAETAE_RANDOMBYTES_H */

data/vendor/HAETAE/include/rans_byte.h

@@ -0,0 +1,335 @@
+// Simple byte-aligned rANS encoder/decoder - public domain - Fabian 'ryg'
+// Giesen 2014
+//
+// Not intended to be "industrial strength"; just meant to illustrate the
+// general idea.
+
+#ifndef RANS_BYTE_HEADER
+#define RANS_BYTE_HEADER
+
+#include <stdint.h>
+
+#ifdef assert
+#define RansAssert assert
+#else
+#define RansAssert(x)
+#endif
+
+// READ ME FIRST:
+//
+// This is designed like a typical arithmetic coder API, but there's three
+// twists you absolutely should be aware of before you start hacking:
+//
+// 1. You need to encode data in *reverse* - last symbol first. rANS works
+//    like a stack: last in, first out.
+// 2. Likewise, the encoder outputs bytes *in reverse* - that is, you give
+//    it a pointer to the *end* of your buffer (exclusive), and it will
+//    slowly move towards the beginning as more bytes are emitted.
+// 3. Unlike basically any other entropy coder implementation you might
+//    have used, you can interleave data from multiple independent rANS
+//    encoders into the same bytestream without any extra signaling;
+//    you can also just write some bytes by yourself in the middle if
+//    you want to. This is in addition to the usual arithmetic encoder
+//    property of being able to switch models on the fly. Writing raw
+//    bytes can be useful when you have some data that you know is
+//    incompressible, and is cheaper than going through the rANS encode
+//    function. Using multiple rANS coders on the same byte stream wastes
+//    a few bytes compared to using just one, but execution of two
+//    independent encoders can happen in parallel on superscalar and
+//    Out-of-Order CPUs, so this can be *much* faster in tight decoding
+//    loops.
+//
+//    This is why all the rANS functions take the write pointer as an
+//    argument instead of just storing it in some context struct.
+
+// --------------------------------------------------------------------------
+
+// L ('l' in the paper) is the lower bound of our normalization interval.
+// Between this and our byte-aligned emission, we use 31 (not 32!) bits.
+// This is done intentionally because exact reciprocals for 31-bit uints
+// fit in 32-bit uints: this permits some optimizations during encoding.
+#define RANS_BYTE_L (1u << 23) // lower bound of our normalization interval
+
+// State for a rANS encoder. Yep, that's all there is to it.
+typedef uint32_t RansState;
+
+// Initialize a rANS encoder.
+static inline void RansEncInit(RansState *r) { *r = RANS_BYTE_L; }
+
+// Renormalize the encoder. Internal function.
+static inline RansState RansEncRenorm(RansState x, uint8_t **pptr,
+                                      uint32_t freq, uint32_t scale_bits) {
+  uint32_t x_max =
+      ((RANS_BYTE_L >> scale_bits) << 8) * freq; // this turns into a shift.
+  if (x >= x_max) {
+    uint8_t *ptr = *pptr;
+    do {
+      *--ptr = (uint8_t)(x & 0xff);
+      x >>= 8;
+    } while (x >= x_max);
+    *pptr = ptr;
+  }
+  return x;
+}
+
+// Encodes a single symbol with range start "start" and frequency "freq".
+// All frequencies are assumed to sum to "1 << scale_bits", and the
+// resulting bytes get written to ptr (which is updated).
+//
+// NOTE: With rANS, you need to encode symbols in *reverse order*, i.e. from
+// beginning to end! Likewise, the output bytestream is written *backwards*:
+// ptr starts pointing at the end of the output buffer and keeps decrementing.
+static inline void RansEncPut(RansState *r, uint8_t **pptr, uint32_t start,
+                              uint32_t freq, uint32_t scale_bits) {
+  // renormalize
+  RansState x = RansEncRenorm(*r, pptr, freq, scale_bits);
+
+  // x = C(s,x)
+  *r = ((x / freq) << scale_bits) + (x % freq) + start;
+}
+
+// Flushes the rANS encoder.
+static inline void RansEncFlush(RansState *r, uint8_t **pptr) {
+  uint32_t x = *r;
+  uint8_t *ptr = *pptr;
+
+  ptr -= 4;
+  ptr[0] = (uint8_t)(x >> 0);
+  ptr[1] = (uint8_t)(x >> 8);
+  ptr[2] = (uint8_t)(x >> 16);
+  ptr[3] = (uint8_t)(x >> 24);
+
+  *pptr = ptr;
+}
+
+// Initializes a rANS decoder.
+// Unlike the encoder, the decoder works forwards as you'd expect.
+static inline int RansDecInit(RansState *r, uint8_t **pptr) {
+  uint32_t x;
+  uint8_t *ptr = *pptr;
+
+  x = (uint32_t)ptr[0] << 0;
+  x |= (uint32_t)ptr[1] << 8;
+  x |= (uint32_t)ptr[2] << 16;
+  x |= (uint32_t)ptr[3] << 24;
+  if (x < RANS_BYTE_L || (RANS_BYTE_L << 8) <= x)
+    return 1; // initial state out of range
+
+  ptr += 4;
+  *pptr = ptr;
+  *r = x;
+  return 0;
+}
+
+// Returns the current cumulative frequency (map it to a symbol yourself!)
+static inline uint32_t RansDecGet(RansState *r, uint32_t scale_bits) {
+  return *r & ((1u << scale_bits) - 1);
+}
+
+// Advances in the bit stream by "popping" a single symbol with range start
+// "start" and frequency "freq". All frequencies are assumed to sum to "1 <<
+// scale_bits", and the resulting bytes get written to ptr (which is updated).
+static inline void RansDecAdvance(RansState *r, uint8_t **pptr,
+                                  const uint8_t *end, uint32_t start,
+                                  uint32_t freq, uint32_t scale_bits) {
+  uint32_t mask = (1u << scale_bits) - 1;
+
+  // s, x = D(x)
+  uint32_t x = *r;
+  x = freq * (x >> scale_bits) + (x & mask) - start;
+
+  // renormalize
+  if (x < RANS_BYTE_L && *pptr < end) {
+    uint8_t *ptr = *pptr;
+    do
+      x = (x << 8) | *ptr++;
+    while (x < RANS_BYTE_L && ptr < end);
+    *pptr = ptr;
+  }
+
+  *r = x;
+}
+
+// --------------------------------------------------------------------------
+
+// That's all you need for a full encoder; below here are some utility
+// functions with extra convenience or optimizations.
+
+// Encoder symbol description
+// This (admittedly odd) selection of parameters was chosen to make
+// RansEncPutSymbol as cheap as possible.
+typedef struct {
+  uint32_t x_max;     // (Exclusive) upper bound of pre-normalization interval
+  uint32_t rcp_freq;  // Fixed-point reciprocal frequency
+  uint32_t bias;      // Bias
+  uint16_t cmpl_freq; // Complement of frequency: (1 << scale_bits) - freq
+  uint16_t rcp_shift; // Reciprocal shift
+} RansEncSymbol;
+
+// Decoder symbols are straightforward.
+typedef struct {
+  uint16_t start; // Start of range.
+  uint16_t freq;  // Symbol frequency.
+} RansDecSymbol;
+
+// Initializes an encoder symbol to start "start" and frequency "freq"
+static inline void RansEncSymbolInit(RansEncSymbol *s, uint32_t start,
+                                     uint32_t freq, uint32_t scale_bits) {
+  RansAssert(scale_bits <= 16);
+  RansAssert(start <= (1u << scale_bits));
+  RansAssert(freq <= (1u << scale_bits) - start);
+
+  // Say M := 1 << scale_bits.
+  //
+  // The original encoder does:
+  //   x_new = (x/freq)*M + start + (x%freq)
+  //
+  // The fast encoder does (schematically):
+  //   q     = mul_hi(x, rcp_freq) >> rcp_shift   (division)
+  //   r     = x - q*freq                         (remainder)
+  //   x_new = q*M + bias + r                     (new x)
+  // plugging in r into x_new yields:
+  //   x_new = bias + x + q*(M - freq)
+  //        =: bias + x + q*cmpl_freq             (*)
+  //
+  // and we can just precompute cmpl_freq. Now we just need to
+  // set up our parameters such that the original encoder and
+  // the fast encoder agree.
+
+  s->x_max = ((RANS_BYTE_L >> scale_bits) << 8) * freq;
+  s->cmpl_freq = (uint16_t)((1 << scale_bits) - freq);
+  if (freq < 2) {
+    // freq=0 symbols are never valid to encode, so it doesn't matter what
+    // we set our values to.
+    //
+    // freq=1 is tricky, since the reciprocal of 1 is 1; unfortunately,
+    // our fixed-point reciprocal approximation can only multiply by values
+    // smaller than 1.
+    //
+    // So we use the "next best thing": rcp_freq=0xffffffff, rcp_shift=0.
+    // This gives:
+    //   q = mul_hi(x, rcp_freq) >> rcp_shift
+    //     = mul_hi(x, (1<<32) - 1)) >> 0
+    //     = floor(x - x/(2^32))
+    //     = x - 1 if 1 <= x < 2^32
+    // and we know that x>0 (x=0 is never in a valid normalization interval).
+    //
+    // So we now need to choose the other parameters such that
+    //   x_new = x*M + start
+    // plug it in:
+    //     x*M + start                   (desired result)
+    //   = bias + x + q*cmpl_freq        (*)
+    //   = bias + x + (x - 1)*(M - 1)    (plug in q=x-1, cmpl_freq)
+    //   = bias + 1 + (x - 1)*M
+    //   = x*M + (bias + 1 - M)
+    //
+    // so we have start = bias + 1 - M, or equivalently
+    //   bias = start + M - 1.
+    s->rcp_freq = ~0u;
+    s->rcp_shift = 0;
+    s->bias = start + (1 << scale_bits) - 1;
+  } else {
+    // Alverson, "Integer Division using reciprocals"
+    // shift=ceil(log2(freq))
+    uint32_t shift = 0;
+    while (freq > (1u << shift))
+      shift++;
+
+    s->rcp_freq = (uint32_t)(((1ull << (shift + 31)) + freq - 1) / freq);
+    s->rcp_shift = shift - 1;
+
+    // With these values, 'q' is the correct quotient, so we
+    // have bias=start.
+    s->bias = start;
+  }
+}
+
+// Initialize a decoder symbol to start "start" and frequency "freq"
+static inline void RansDecSymbolInit(RansDecSymbol *s, uint32_t start,
+                                     uint32_t freq) {
+  RansAssert(start <= (1 << 16));
+  RansAssert(freq <= (1 << 16) - start);
+  s->start = (uint16_t)start;
+  s->freq = (uint16_t)freq;
+}
+
+// Encodes a given symbol. This is faster than straight RansEnc since we can do
+// multiplications instead of a divide.
+//
+// See RansEncSymbolInit for a description of how this works.
+static inline void RansEncPutSymbol(RansState *r, uint8_t **pptr,
+                                    RansEncSymbol const *sym) {
+  RansAssert(sym->x_max != 0); // can't encode symbol with freq=0
+
+  // renormalize
+  uint32_t x = *r;
+  uint32_t x_max = sym->x_max;
+  if (x >= x_max) {
+    uint8_t *ptr = *pptr;
+    do {
+      *--ptr = (uint8_t)(x & 0xff);
+      x >>= 8;
+    } while (x >= x_max);
+    *pptr = ptr;
+  }
+
+  // x = C(s,x)
+  // NOTE: written this way so we get a 32-bit "multiply high" when
+  // available. If you're on a 64-bit platform with cheap multiplies
+  // (e.g. x64), just bake the +32 into rcp_shift.
+  uint32_t q =
+      (uint32_t)(((uint64_t)x * sym->rcp_freq) >> 32) >> sym->rcp_shift;
+  *r = x + sym->bias + q * sym->cmpl_freq;
+}
+
+// Equivalent to RansDecAdvance that takes a symbol.
+static inline void RansDecAdvanceSymbol(RansState *r, uint8_t **pptr,
+                                        const uint8_t *end,
+                                        RansDecSymbol const *sym,
+                                        uint32_t scale_bits) {
+  RansDecAdvance(r, pptr, end, sym->start, sym->freq, scale_bits);
+}
+
+// Advances in the bit stream by "popping" a single symbol with range start
+// "start" and frequency "freq". All frequencies are assumed to sum to "1 <<
+// scale_bits". No renormalization or output happens.
+static inline void RansDecAdvanceStep(RansState *r, uint32_t start,
+                                      uint32_t freq, uint32_t scale_bits) {
+  uint32_t mask = (1u << scale_bits) - 1;
+
+  // s, x = D(x)
+  uint32_t x = *r;
+  *r = freq * (x >> scale_bits) + (x & mask) - start;
+}
+
+// Equivalent to RansDecAdvanceStep that takes a symbol.
+static inline void RansDecAdvanceSymbolStep(RansState *r,
+                                            RansDecSymbol const *sym,
+                                            uint32_t scale_bits) {
+  RansDecAdvanceStep(r, sym->start, sym->freq, scale_bits);
+}
+
+// Renormalize.
+static inline void RansDecRenorm(RansState *r, uint8_t **pptr) {
+  // renormalize
+  uint32_t x = *r;
+  if (x < RANS_BYTE_L) {
+    uint8_t *ptr = *pptr;
+    do
+      x = (x << 8) | *ptr++;
+    while (x < RANS_BYTE_L);
+    *pptr = ptr;
+  }
+
+  *r = x;
+}
+
+// Verify final state
+static inline int RansDecVerify(const RansState *const r) {
+  if (*r != RANS_BYTE_L) {
+    return 1; // the final state is inconsistent with the initial state
+  }
+  return 0;
+}
+
+#endif // RANS_BYTE_HEADER