kpqc 0.1.0

data/vendor/HAETAE/include/reduce.h

@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_REDUCE_H
+#define HAETAE_REDUCE_H
+
+#include "params.h"
+
+#include <stdint.h>
+
+#define MONT 14321     // 2^32 % HAETAE_Q
+#define MONTSQ 4214    // 2^64 % HAETAE_Q
+#define QINV 940508161 // q^(-1) mod 2^32
+#define QREC 66575     // 2^32 / HAETAE_Q for Barrett
+#define DQREC 33287    // 2^32 / DQ for Barrett
+
+#define montgomery_reduce HAETAE_NAMESPACE(montgomery_reduce)
+int32_t montgomery_reduce(int64_t a);
+
+#define caddq HAETAE_NAMESPACE(caddq)
+int32_t caddq(int32_t a);
+
+#define freeze HAETAE_NAMESPACE(freeze)
+int32_t freeze(int32_t a);
+
+#define reduce32_2q HAETAE_NAMESPACE(reduce32_2q)
+int32_t reduce32_2q(int32_t a);
+
+#define freeze2q HAETAE_NAMESPACE(freeze2q)
+int32_t freeze2q(int32_t a);
+
+#endif /* !HAETAE_REDUCE_H */

data/vendor/HAETAE/include/sampler.h

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_SAMPLER_H
+#define HAETAE_SAMPLER_H
+
+#include "fixpoint.h"
+#include "params.h"
+
+#include <stdint.h>
+
+#define rej_uniform HAETAE_NAMESPACE(rej_uniform)
+unsigned int rej_uniform(int32_t *a, unsigned int len, const uint8_t *buf,
+                         unsigned int buflen);
+#define rej_eta HAETAE_NAMESPACE(rej_eta)
+unsigned int rej_eta(int32_t *a, unsigned int len, const uint8_t *buf,
+                     unsigned int buflen);
+
+#define sample_gauss_N HAETAE_NAMESPACE(sample_gauss_N)
+void sample_gauss_N(uint64_t *r, uint8_t *signs, fp96_76 *sqsum,
+                    const uint8_t seed[HAETAE_CRHBYTES], uint16_t nonce,
+                    size_t len);
+
+#endif /* !HAETAE_SAMPLER_H */

data/vendor/HAETAE/include/symmetric.h

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef HAETAE_SYMMETRIC_H
+#define HAETAE_SYMMETRIC_H
+
+#include "fips202.h"
+#include "params.h"
+
+#include <stdint.h>
+
+typedef keccak_state xof256_state;
+
+void shake256_absorb_twice(keccak_state *state, const uint8_t *in1,
+                           size_t in1len, const uint8_t *in2, size_t in2len);
+void shake256_absorb_thrice(keccak_state *state, const uint8_t *in1,
+                            size_t in1len, const uint8_t *in2, size_t in2len,
+                            const uint8_t *in3, size_t in3len);
+
+#define XOF256_BLOCKBYTES SHAKE256_RATE
+
+#define xof256_absorb_once(STATE, IN, IN_LEN)                                  \
+  shake256_absorb_once(STATE, IN, IN_LEN)
+#define xof256_absorb_twice(STATE, IN, IN_LEN, IN2, IN2_LEN)                   \
+  shake256_absorb_twice(STATE, IN, IN_LEN, IN2, IN2_LEN)
+#define xof256_absorb_thrice(STATE, IN, IN_LEN, IN2, IN2_LEN, IN3, IN3_LEN)    \
+  shake256_absorb_thrice(STATE, IN, IN_LEN, IN2, IN2_LEN, IN3, IN3_LEN)
+#define xof256_squeeze(OUT, OUT_LEN, STATE)                                    \
+  shake256_squeeze(OUT, OUT_LEN, STATE)
+#define xof256_squeezeblocks(OUT, OUTBLOCKS, STATE)                            \
+  shake256_squeezeblocks(OUT, OUTBLOCKS, STATE)
+
+typedef keccak_state stream128_state;
+typedef keccak_state stream256_state;
+
+void shake128_stream_init(keccak_state *state,
+                          const uint8_t seed[HAETAE_SEEDBYTES], uint16_t nonce);
+void shake256_stream_init(keccak_state *state,
+                          const uint8_t seed[HAETAE_CRHBYTES], uint16_t nonce);
+
+#define STREAM128_BLOCKBYTES SHAKE128_RATE // 168
+#define STREAM256_BLOCKBYTES SHAKE256_RATE // 136
+
+#define stream128_init(STATE, SEED, NONCE)                                     \
+  shake128_stream_init(STATE, SEED, NONCE)
+#define stream128_squeezeblocks(OUT, OUTBLOCKS, STATE)                         \
+  shake128_squeezeblocks(OUT, OUTBLOCKS, STATE)
+#define stream256_init(STATE, SEED, NONCE)                                     \
+  shake256_stream_init(STATE, SEED, NONCE)
+#define stream256_squeezeblocks(OUT, OUTBLOCKS, STATE)                         \
+  shake256_squeezeblocks(OUT, OUTBLOCKS, STATE)
+
+#endif /* !HAETAE_SYMMETRIC_H */

data/vendor/HAETAE/src/decompose.c

@@ -0,0 +1,73 @@
+// SPDX-License-Identifier: MIT
+
+#include "decompose.h"
+#include "params.h"
+
+#include <stdint.h>
+
+/*************************************************
+ * Name:        decompose_z1
+ *
+ * Description: For finite field element r, compute high and lowbits
+ *              hb, lb such that r = hb * b + lb with -b/4 < lb <= b/4.
+ *
+ * Arguments:   - int32_t r: input element
+ *              - int32_t *lowbits: pointer to output element lb
+ *              - int32_t *highbits: pointer to output element hb
+ **************************************************/
+void decompose_z1(int32_t *highbits, int32_t *lowbits, const int32_t r) {
+  const int alpha = 256; // Algorithm parameter.
+  const int log_alpha = 8;
+
+  int32_t lb, center;
+  uint32_t alpha_mask = alpha - 1;
+
+  lb = r & alpha_mask;
+  center = ((alpha >> 1) - (lb + 1)) >> 31; // if lb >= HALF_ALPHA
+  lb -= alpha & center;
+  *lowbits = lb;
+  *highbits = (r + (alpha >> 1)) >> log_alpha;
+}
+
+/*************************************************
+ * Name:        decompose_hint
+ *
+ * Description: For finite field element r, compute highbits
+ *              hb, lb such that r = hb * b + lb with -b/4 < lb <= b/4.
+ *
+ * Arguments:   - int32_t r: input element
+ *              - int32_t *highbits: pointer to output element hb
+ *
+ * Specification: Implements Algorithm 20, DecomposeHint.
+ **************************************************/
+
+void decompose_hint(int32_t *highbits, const int32_t r) {
+  int32_t hb, edgecase;
+
+  hb = (r + HAETAE_HALF_ALPHA_HINT) >> HAETAE_LOG_ALPHA_HINT;
+  edgecase = ((HAETAE_DQ - 2) / HAETAE_ALPHA_HINT - (hb + 1)) >>
+             31; // if hb == (HAETAE_DQ-2)/ALPHA
+  hb -= (HAETAE_DQ - 2) / HAETAE_ALPHA_HINT & edgecase; // hb = 0
+
+  *highbits = hb;
+}
+
+/*************************************************
+ * Name:        decompose_vk
+ *
+ * Description: For finite field element a, compute a0, a1 such that
+ *              a mod^+ HAETAE_Q = a1*2^D + a0 with -2^{D-1} <= a0 < 2^{D-1}.
+ *              Assumes a to be standard representative.
+ *
+ * Arguments:   - int32_t a: input element
+ *              - int32_t *a0: pointer to output element a0
+ *
+ * Returns:     - a1
+ *
+ * Specification: Implements Algorithm 17, DecomposeVK.
+ **************************************************/
+int32_t decompose_vk(int32_t *a0, const int32_t a) {
+  *a0 = a & 1;
+  *a0 -= ((a >> 1) & *a0) << 1;
+  return (a - *a0) >> 1;
+}