kpqc 0.1.0

data/vendor/HAETAE/src/poly.c

@@ -0,0 +1,371 @@
+// SPDX-License-Identifier: MIT
+
+#include "poly.h"
+#include "decompose.h"
+#include "ntt.h"
+#include "params.h"
+#include "reduce.h"
+#include "sampler.h"
+#include "symmetric.h"
+
+#include <stdint.h>
+
+/*************************************************
+ * Name:        poly_add
+ *
+ * Description: Add polynomials. No modular reduction is performed.
+ *
+ * Arguments:   - poly *c: pointer to output polynomial
+ *              - const poly *a: pointer to first summand
+ *              - const poly *b: pointer to second summand
+ **************************************************/
+void poly_add(poly *c, const poly *a, const poly *b) {
+  unsigned int i;
+
+  for (i = 0; i < HAETAE_N; ++i)
+    c->coeffs[i] = a->coeffs[i] + b->coeffs[i];
+}
+
+/*************************************************
+ * Name:        poly_sub
+ *
+ * Description: Subtract polynomials. No modular reduction is
+ *              performed.
+ *
+ * Arguments:   - poly *c: pointer to output polynomial
+ *              - const poly *a: pointer to first input polynomial
+ *              - const poly *b: pointer to second input polynomial to be
+ *              subtraced from first input polynomial
+ **************************************************/
+void poly_sub(poly *c, const poly *a, const poly *b) {
+  unsigned int i;
+
+  for (i = 0; i < HAETAE_N; ++i)
+    c->coeffs[i] = a->coeffs[i] - b->coeffs[i];
+}
+
+/*************************************************
+ * Name:        poly_pointwise_montgomery
+ *
+ * Description: Pointwise multiplication of polynomials in NTT domain
+ *              representation and multiplication of resulting polynomial
+ *              by 2^{-32}.
+ *
+ * Arguments:   - poly *c: pointer to output polynomial
+ *              - const poly *a: pointer to first input polynomial
+ *              - const poly *b: pointer to second input polynomial
+ **************************************************/
+void poly_pointwise_montgomery(poly *c, const poly *a, const poly *b) {
+  unsigned int i;
+
+  for (i = 0; i < HAETAE_N; ++i)
+    c->coeffs[i] = montgomery_reduce((int64_t)a->coeffs[i] * b->coeffs[i]);
+}
+
+/*************************************************
+ * Name:        poly_reduce2q
+ *
+ * Description: Inplace reduction of all coefficients of polynomial to 2q
+ *
+ * Arguments:   - poly *a: pointer to input/output polynomial
+ **************************************************/
+void poly_reduce2q(poly *a) {
+  unsigned int i;
+
+  for (i = 0; i < HAETAE_N; ++i)
+    a->coeffs[i] = reduce32_2q(a->coeffs[i]);
+}
+
+/*************************************************
+ * Name:        poly_freeze2q
+ *
+ * Description: For all coefficients of in/out polynomial compute standard
+ *              representative r = a mod^+ 2Q
+ *
+ * Arguments:   - poly *a: pointer to input/output polynomial
+ **************************************************/
+void poly_freeze2q(poly *a) {
+  unsigned int i;
+
+  for (i = 0; i < HAETAE_N; ++i)
+    a->coeffs[i] = freeze2q(a->coeffs[i]);
+}
+
+/*************************************************
+ * Name:        poly_freeze
+ *
+ * Description: For all coefficients of in/out polynomial compute standard
+ *              representative r = a mod^+ HAETAE_Q
+ *
+ * Arguments:   - poly *a: pointer to input/output polynomial
+ **************************************************/
+void poly_freeze(poly *a) {
+  unsigned int i;
+
+  for (i = 0; i < HAETAE_N; ++i)
+    a->coeffs[i] = freeze(a->coeffs[i]);
+}
+
+/*************************************************
+ * Name:        poly_highbits
+ *
+ * Description: Compute HighBits of polynomial
+ *
+ * Arguments:   - poly *a2: pointer to output polynomial
+ *              - const poly *a: pointer to input polynomial
+ **************************************************/
+void poly_highbits(poly *a2, const poly *a) {
+  unsigned int i;
+  int32_t a1tmp;
+
+  for (i = 0; i < HAETAE_N; ++i)
+    decompose_z1(&a2->coeffs[i], &a1tmp, a->coeffs[i]);
+}
+
+/*************************************************
+ * Name:        poly_lowbits
+ *
+ * Description: Compute LowBits of polynomial
+ *
+ * Arguments:   - poly *a1: pointer to output polynomial
+ *              - const poly *a: pointer to input polynomial
+ **************************************************/
+void poly_lowbits(poly *a1, const poly *a) {
+  unsigned int i = 0;
+  int32_t a2tmp = 0;
+
+  for (i = 0; i < HAETAE_N; ++i)
+    decompose_z1(&a2tmp, &a1->coeffs[i], a->coeffs[i]);
+}
+
+/*************************************************
+ * Name:        poly_compose
+ *
+ * Description: Compose HighBits and LowBits to recreate the polynomial
+ *
+ * Arguments:   - poly *a3: pointer to output polynomial
+ *              - const poly *ha: pointer to HighBits polynomial
+ *              - const poly *la: pointer to HighBits polynomial
+ **************************************************/
+void poly_compose(poly *a, const poly *ha, const poly *la) {
+  unsigned int i = 0;
+
+  for (i = 0; i < HAETAE_N; ++i)
+    a->coeffs[i] = (ha->coeffs[i] * 256) + la->coeffs[i];
+}
+
+/*************************************************
+ * Name:        poly_lsb
+ *
+ * Description: Compute least significant bits of polynomial
+ *
+ * Arguments:   - poly *a0: pointer to output polynomial
+ *              - const poly *a: pointer to input polynomial
+ **************************************************/
+void poly_lsb(poly *a0, const poly *a) {
+  unsigned int i;
+
+  for (i = 0; i < HAETAE_N; ++i)
+    a0->coeffs[i] = a->coeffs[i] & 1;
+}
+
+/*************************************************
+ * Name:        poly_uniform
+ *
+ * Description: Sample polynomial with uniformly random coefficients
+ *              in [0,Q-1] by performing rejection sampling on the
+ *              output stream of SHAKE128(seed|nonce)
+ *
+ * Arguments:   - poly *a: pointer to output polynomial
+ *              - const uint8_t seed[]: byte array with seed of length
+ *              HAETAE_SEEDBYTES
+ *              - uint16_t nonce: 2-byte nonce
+ *
+ * Specification: Implements Algorithm 6, PolyUniform.
+ **************************************************/
+#define POLY_UNIFORM_NBLOCKS                                                   \
+  ((512 + STREAM128_BLOCKBYTES - 1) / STREAM128_BLOCKBYTES)
+// HAETAE_N * 2(random bytes for [0, HAETAE_Q - 1])
+
+void poly_uniform(poly *a, const uint8_t seed[HAETAE_SEEDBYTES],
+                  uint16_t nonce) {
+  unsigned int i, ctr, off;
+  unsigned int buflen = POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES;
+  uint8_t buf[POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES + 1];
+  stream128_state state;
+
+  stream128_init(&state, seed, nonce);
+  stream128_squeezeblocks(buf, POLY_UNIFORM_NBLOCKS, &state);
+
+  ctr = rej_uniform(a->coeffs, HAETAE_N, buf, buflen);
+
+  while (ctr < HAETAE_N) {
+    off = buflen % 2;
+    for (i = 0; i < off; ++i)
+      buf[i] = buf[buflen - off + i];
+
+    stream128_squeezeblocks(buf + off, 1, &state);
+    buflen = STREAM128_BLOCKBYTES + off;
+    ctr += rej_uniform(a->coeffs + ctr, HAETAE_N - ctr, buf, buflen);
+  }
+}
+
+/*************************************************
+ * Name:        poly_uniform_eta
+ *
+ * Description: Sample polynomial with uniformly random coefficients
+ *              in [-ETA,ETA] by performing rejection sampling on the
+ *              output stream from SHAKE256(seed|nonce)
+ *
+ * Arguments:   - poly *a: pointer to output polynomial
+ *              - const uint8_t seed[]: byte array with seed of length
+ *              HAETAE_CRHBYTES
+ *              - uint16_t nonce: 2-byte nonce
+ *
+ * Specification: Implements Algorithm 9, PolyUniformEta.
+ **************************************************/
+#define POLY_UNIFORM_ETA_NBLOCKS                                               \
+  ((136 + STREAM256_BLOCKBYTES - 1) / STREAM256_BLOCKBYTES) // 1
+
+void poly_uniform_eta(poly *a, const uint8_t seed[HAETAE_CRHBYTES],
+                      uint16_t nonce) {
+  unsigned int ctr;
+  unsigned int buflen = POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES;
+  uint8_t buf[POLY_UNIFORM_ETA_NBLOCKS * STREAM256_BLOCKBYTES];
+  stream256_state state;
+
+  stream256_init(&state, seed, nonce);
+  stream256_squeezeblocks(buf, POLY_UNIFORM_ETA_NBLOCKS, &state);
+
+  ctr = rej_eta(a->coeffs, HAETAE_N, buf, buflen);
+
+  while (ctr < HAETAE_N) {
+    stream256_squeezeblocks(buf, 1, &state);
+    ctr += rej_eta(a->coeffs + ctr, HAETAE_N - ctr, buf, STREAM256_BLOCKBYTES);
+  }
+}
+
+uint8_t hammingWeight_8(uint8_t x) {
+  x = (x & 0x55) + (x >> 1 & 0x55);
+  x = (x & 0x33) + (x >> 2 & 0x33);
+  x = (x & 0x0F) + (x >> 4 & 0x0F);
+
+  return x;
+}
+
+/*************************************************
+ * Name:        poly_challenge
+ *
+ * Description: Implementation of challenge. Samples polynomial with HAETAE_TAU
+ *              1 coefficients using the output stream of SHAKE256(seed).
+ *
+ * Arguments:   - poly *c: pointer to output polynomial
+ *              - const uint8_t highbits_lsb[]: packed highbits and lsb
+ *              - const uint8_t mu[]: hash of vk and message
+ *
+ * Specification: Implements Algorithm 16, SampleChallenge.
+ **************************************************/
+void poly_challenge(
+    poly *c,
+    const uint8_t highbits_lsb[HAETAE_POLYVECK_HIGHBITS_PACKEDBYTES +
+                               HAETAE_POLYC_PACKEDBYTES],
+    const uint8_t mu[HAETAE_SEEDBYTES]) {
+#if (HAETAE_MODE == HAETAE_MODE2) || (HAETAE_MODE == HAETAE_MODE3)
+  unsigned int i, b, pos = 0;
+  uint8_t buf[XOF256_BLOCKBYTES];
+  xof256_state state;
+
+  // H(HighBits(A * y mod 2q), LSB(round(y0) * j), HAETAE_M)
+  xof256_absorb_twice(&state, highbits_lsb,
+                      HAETAE_POLYVECK_HIGHBITS_PACKEDBYTES +
+                          HAETAE_POLYC_PACKEDBYTES,
+                      mu, HAETAE_SEEDBYTES);
+  xof256_squeezeblocks(buf, 1, &state);
+
+  for (i = 0; i < HAETAE_N; ++i)
+    c->coeffs[i] = 0;
+  for (i = HAETAE_N - HAETAE_TAU; i < HAETAE_N; ++i) {
+    do {
+      if (pos >= XOF256_BLOCKBYTES) {
+        xof256_squeezeblocks(buf, 1, &state);
+        pos = 0;
+      }
+
+      b = buf[pos++];
+    } while (b > i);
+
+    c->coeffs[i] = c->coeffs[b];
+    c->coeffs[b] = 1;
+  }
+#elif HAETAE_MODE == HAETAE_MODE5
+  unsigned int i, hwt = 0, cond = 0;
+  uint8_t mask = 0, w0 = 0;
+  uint8_t buf[32] = {0};
+  xof256_state state;
+
+  // H(HighBits(A * y mod 2q), LSB(round(y0) * j), HAETAE_M)
+  xof256_absorb_twice(&state, highbits_lsb,
+                      HAETAE_POLYVECK_HIGHBITS_PACKEDBYTES +
+                          HAETAE_POLYC_PACKEDBYTES,
+                      mu, HAETAE_SEEDBYTES);
+  xof256_squeeze(buf, 32, &state);
+
+  for (i = 0; i < 32; ++i)
+    hwt += hammingWeight_8(buf[i]);
+
+  cond = (128 - hwt);
+  mask = 0xff & (cond >> 8);
+  w0 = -(buf[0] & 1);
+  mask = w0 ^ ((-(!!cond & 1)) & (mask ^ w0)); // mask = !!cond ? mask : w0
+  for (i = 0; i < 32; ++i) {
+    buf[i] ^= mask;
+    c->coeffs[8 * i] = buf[i] & 1;
+    c->coeffs[8 * i + 1] = (buf[i] >> 1) & 1;
+    c->coeffs[8 * i + 2] = (buf[i] >> 2) & 1;
+    c->coeffs[8 * i + 3] = (buf[i] >> 3) & 1;
+    c->coeffs[8 * i + 4] = (buf[i] >> 4) & 1;
+    c->coeffs[8 * i + 5] = (buf[i] >> 5) & 1;
+    c->coeffs[8 * i + 6] = (buf[i] >> 6) & 1;
+    c->coeffs[8 * i + 7] = (buf[i] >> 7) & 1;
+  }
+#endif
+}
+
+void poly_decomposed_pack(uint8_t *buf, const poly *a) {
+  unsigned int i;
+  for (i = 0; i < HAETAE_N; i++) {
+    buf[i] = a->coeffs[i];
+  }
+}
+
+void poly_decomposed_unpack(poly *a, const uint8_t *buf) {
+  unsigned int i;
+  for (i = 0; i < HAETAE_N; i++) {
+    a->coeffs[i] = (int8_t)buf[i];
+  }
+}
+
+void poly_fromcrt(poly *w, const poly *u, const poly *v) {
+  unsigned int i;
+  int32_t xq, x2;
+
+  for (i = 0; i < HAETAE_N; i++) {
+    xq = u->coeffs[i];
+    x2 = v->coeffs[i];
+    w->coeffs[i] = xq + (HAETAE_Q & -((xq ^ x2) & 1));
+  }
+}
+
+void poly_fromcrt0(poly *w, const poly *u) {
+  unsigned int i;
+  int32_t xq;
+
+  for (i = 0; i < HAETAE_N; i++) {
+    xq = u->coeffs[i];
+    w->coeffs[i] = xq + (HAETAE_Q & -(xq & 1));
+  }
+}
+
+void poly_ntt(poly *a) { ntt(&a->coeffs[0]); }
+
+void poly_invntt_tomont(poly *a) { invntt_tomont(&a->coeffs[0]); }

data/vendor/HAETAE/src/polyfix.c

@@ -0,0 +1,298 @@
+// SPDX-License-Identifier: MIT
+
+#include "polyfix.h"
+#include "fips202.h"
+#include "fixpoint.h"
+#include "params.h"
+#include "sampler.h"
+
+#include <stdint.h>
+
+/*************************************************
+ * Name:        polyfix_add
+ *
+ * Description: Add double polynomial and integer polynomial.
+ *              No modular reduction is performed.
+ *
+ * Arguments:   - polyfix *c: pointer to output double polynomial
+ *              - const polyfix *a: pointer to first summand
+ *              - const poly *b: pointer to second summand
+ **************************************************/
+void polyfix_add(polyfix *c, const polyfix *a, const poly *b) {
+  unsigned int i;
+
+  for (i = 0; i < HAETAE_N; ++i)
+    c->coeffs[i] = a->coeffs[i] + HAETAE_LN * b->coeffs[i];
+}
+
+/*************************************************
+ * Name:        polyfixfix_sub
+ *
+ * Description: Subtract fixed polynomial and fixed polynomial.
+ *              No modular reduction is performed.
+ *
+ * Arguments:   - polyfix *c: pointer to output fixed polynomial
+ *              - const polyfix *a: pointer to first summand
+ *              - const polyfix *b: pointer to second summand
+ **************************************************/
+void polyfixfix_sub(polyfix *c, const polyfix *a, const polyfix *b) {
+  unsigned int i;
+
+  for (i = 0; i < HAETAE_N; ++i)
+    c->coeffs[i] = a->coeffs[i] - b->coeffs[i];
+}
+
+int32_t fix_round(int32_t num) {
+  return (num + HAETAE_LNHALF) >> HAETAE_LNBITS;
+}
+
+/*************************************************
+ * Name:        polyfix_round
+ *
+ * Description: rounds a fixed polynomial to integer polynomial
+ *
+ * Arguments:   - poly *a: output integer polynomial
+ *              - poly *b: input fixed polynomial
+ **************************************************/
+void polyfix_round(poly *a, const polyfix *b) {
+  unsigned i;
+
+  for (i = 0; i < HAETAE_N; ++i)
+    a->coeffs[i] = fix_round(b->coeffs[i]);
+}
+
+/*************************************************
+ * Name:        polyfixveck_add
+ *
+ * Description: Add vector to a vector of double polynomials of length HAETAE_K.
+ *              No modular reduction is performed.
+ *
+ * Arguments:   - polyveck *w: pointer to output vector
+ *              - const polyveck *u: pointer to first summand
+ *              - const polyveck *v: pointer to second summand
+ **************************************************/
+void polyfixveck_add(polyfixveck *w, const polyfixveck *u, const polyveck *v) {
+  unsigned int i;
+
+  for (i = 0; i < HAETAE_K; ++i)
+    polyfix_add(&w->vec[i], &u->vec[i], &v->vec[i]);
+}
+
+/*************************************************
+ * Name:        polyfixfixveck_sub
+ *
+ * Description: subtract vector to a vector of fixed polynomials of length k.
+ *              No modular reduction is performed.
+ *
+ * Arguments:   - polyveck *w: pointer to output vector
+ *              - const polyfixveck *u: pointer to first summand
+ *              - const polyfixveck *v: pointer to second summand
+ **************************************************/
+void polyfixfixveck_sub(polyfixveck *w, const polyfixveck *u,
+                        const polyfixveck *v) {
+  unsigned int i;
+
+  for (i = 0; i < HAETAE_K; ++i)
+    polyfixfix_sub(&w->vec[i], &u->vec[i], &v->vec[i]);
+}
+
+/*************************************************
+ * Name:        polyfixveck_double
+ *
+ * Description: Double vector of polynomials of length HAETAE_K.
+ *
+ * Arguments:   - polyveck *b: pointer to output vector
+ *              - polyveck *a: pointer to input vector
+ **************************************************/
+void polyfixveck_double(polyfixveck *b, const polyfixveck *a) {
+  unsigned int i, j;
+
+  for (i = 0; i < HAETAE_K; ++i)
+    for (j = 0; j < HAETAE_N; ++j)
+      b->vec[i].coeffs[j] = 2 * a->vec[i].coeffs[j];
+}
+
+/*************************************************
+ * Name:        polyfixveck_round
+ *
+ * Description: rounds a fixed polynomial vector of length HAETAE_K
+ *
+ * Arguments:   - polyveck *a: output integer polynomial vector
+ *              - polyfixveck *b: input fixed polynomial vector
+ **************************************************/
+void polyfixveck_round(polyveck *a, const polyfixveck *b) {
+  unsigned i;
+
+  for (i = 0; i < HAETAE_K; ++i)
+    polyfix_round(&a->vec[i], &b->vec[i]);
+}
+
+/*************************************************
+ * Name:        polyfixvecl_add
+ *
+ * Description: Add vector to a vector of double polynomials of length L.
+ *              No modular reduction is performed.
+ *
+ * Arguments:   - polyvecl *w: pointer to output vector
+ *              - const polyfixvecl *u: pointer to first summand
+ *              - const polyvecl *v: pointer to second summand
+ **************************************************/
+void polyfixvecl_add(polyfixvecl *w, const polyfixvecl *u, const polyvecl *v) {
+  unsigned int i;
+
+  for (i = 0; i < HAETAE_L; ++i)
+    polyfix_add(&w->vec[i], &u->vec[i], &v->vec[i]);
+}
+
+/*************************************************
+ * Name:        polyfixfixvecl_sub
+ *
+ * Description: subtract vector to a vector of fixed polynomials of length l.
+ *              No modular reduction is performed.
+ *
+ * Arguments:   - polyvecl *w: pointer to output vector
+ *              - const polyfixvecl *u: pointer to first summand
+ *              - const polyfixvecl *v: pointer to second summand
+ **************************************************/
+void polyfixfixvecl_sub(polyfixvecl *w, const polyfixvecl *u,
+                        const polyfixvecl *v) {
+  unsigned int i;
+
+  for (i = 0; i < HAETAE_L; ++i)
+    polyfixfix_sub(&w->vec[i], &u->vec[i], &v->vec[i]);
+}
+/*************************************************
+ * Name:        polyfixvecl_double
+ *
+ * Description: Double vector of polynomials of length L.
+ *
+ * Arguments:   - polyveck *b: pointer to output vector
+ *              - polyveck *a: pointer to input vector
+ **************************************************/
+void polyfixvecl_double(polyfixvecl *b, const polyfixvecl *a) {
+  unsigned int i, j;
+
+  for (i = 0; i < HAETAE_L; ++i)
+    for (j = 0; j < HAETAE_N; ++j)
+      b->vec[i].coeffs[j] = 2 * a->vec[i].coeffs[j];
+}
+
+/*************************************************
+ * Name:        polyfixvecl_round
+ *
+ * Description: rounds a fixed polynomial vector of length L
+ *
+ * Arguments:   - polyvecl *a: output integer polynomial vector
+ *              - polyfixvecl *b: input fixed polynomial vector
+ **************************************************/
+void polyfixvecl_round(polyvecl *a, const polyfixvecl *b) {
+  unsigned i;
+
+  for (i = 0; i < HAETAE_L; ++i)
+    polyfix_round(&a->vec[i], &b->vec[i]);
+}
+
+/*************************************************
+ * Name:        polyfixveclk_norm2
+ *
+ * Description: Calculates L2 norm of a fixed point polynomial vector with
+ *              length HAETAE_L + HAETAE_K The result is L2 norm * HAETAE_LN
+ *               similar to the way polynomial is usually stored
+ *
+ * Arguments:   - polyfixvecl *a: polynomial vector with length HAETAE_L to
+ *              calculate norm
+ *              - polyfixveck *b: polynomial vector with length HAETAE_K to
+ *              calculate norm
+ **************************************************/
+uint64_t polyfixveclk_sqnorm2(const polyfixvecl *a, const polyfixveck *b) {
+  unsigned int i, j;
+  uint64_t ret = 0;
+
+  for (i = 0; i < HAETAE_L; ++i) {
+    for (j = 0; j < HAETAE_N; ++j)
+      ret += (int64_t)a->vec[i].coeffs[j] * a->vec[i].coeffs[j];
+  }
+
+  for (i = 0; i < HAETAE_K; ++i) {
+    for (j = 0; j < HAETAE_N; ++j)
+      ret += (int64_t)b->vec[i].coeffs[j] * b->vec[i].coeffs[j];
+  }
+
+  return ret;
+}
+
+/*************************************************
+ * Name:        polyfixveclk_sample_hyperball
+ *
+ * Description: sample hyperball
+ *
+ * Arguments:   - polyfixvecl *y1: polynomial vector with length HAETAE_L to
+ *              calculate norm
+ *              - polyfixveck *y2: polynomial vector with length HAETAE_K to
+ *              calculate norm
+ *              - uint8_t *b: output byte
+ *              - uint8_t seed[HAETAE_CRHBYTES]: input seed bytes
+ *              - const uint16_t nonce: input nonce
+ *
+ * Specification: Implements Algorithm 11, SampleHyperBall.
+ **************************************************/
+uint16_t polyfixveclk_sample_hyperball(polyfixvecl *y1, polyfixveck *y2,
+                                       uint8_t *b,
+                                       const uint8_t seed[HAETAE_CRHBYTES],
+                                       const uint16_t nonce) {
+  uint16_t ni = nonce;
+  uint64_t samples[HAETAE_N * (HAETAE_L + HAETAE_K)];
+  fp96_76 sqsum, invsqrt;
+  unsigned int i, j;
+  uint8_t signs[HAETAE_N * (HAETAE_L + HAETAE_K) / 8];
+
+  do {
+    sqsum.limb48[0] = 0;
+    sqsum.limb48[1] = 0;
+
+    sample_gauss_N(&samples[0], &signs[0], &sqsum, seed, ni++, HAETAE_N + 1);
+    sample_gauss_N(&samples[HAETAE_N], &signs[HAETAE_N / 8], &sqsum, seed, ni++,
+                   HAETAE_N + 1);
+
+    for (i = 2; i < HAETAE_L + HAETAE_K; i++)
+      sample_gauss_N(&samples[HAETAE_N * i], &signs[HAETAE_N / 8 * i], &sqsum,
+                     seed, ni++, HAETAE_N);
+
+    // divide sqsum by 2 and approximate inverse square root
+    sqsum.limb48[0] += 1; // rounding
+    sqsum.limb48[0] >>= 1;
+    sqsum.limb48[0] += (sqsum.limb48[1] & 1) << 47;
+    sqsum.limb48[1] >>= 1;
+    sqsum.limb48[1] += sqsum.limb48[0] >> 48;
+    sqsum.limb48[0] &= (1ULL << 48) - 1;
+    fixpoint_newton_invsqrt(&invsqrt, &sqsum);
+    fixpoint_mul_high(&sqsum, &invsqrt,
+                      (uint64_t)(HAETAE_B0 * HAETAE_LN + HAETAE_SQNM / 2)
+                          << (28 - 13));
+
+    for (i = 0; i < HAETAE_L; i++) {
+      for (j = 0; j < HAETAE_N; j++)
+        y1->vec[i].coeffs[j] = fixpoint_mul_rnd13(
+            samples[(i * HAETAE_N + j)], &sqsum,
+            (signs[(i * HAETAE_N + j) / 8] >> ((i * HAETAE_N + j) % 8)) & 1);
+    }
+    for (i = HAETAE_L; i < HAETAE_K + HAETAE_L; i++) {
+      for (j = 0; j < HAETAE_N; j++)
+        y2->vec[i - HAETAE_L].coeffs[j] = fixpoint_mul_rnd13(
+            samples[(i * HAETAE_N + j)], &sqsum,
+            (signs[(i * HAETAE_N + j) / 8] >> ((i * HAETAE_N + j) % 8)) & 1);
+    }
+  } while (polyfixveclk_sqnorm2(y1, y2) > HAETAE_B0SQ * HAETAE_LN * HAETAE_LN);
+
+  {
+    uint8_t tmp[HAETAE_CRHBYTES + 2];
+    for (i = 0; i < HAETAE_CRHBYTES; i++) {
+      tmp[i] = seed[i];
+    }
+    tmp[HAETAE_CRHBYTES + 0] = ni >> 0;
+    tmp[HAETAE_CRHBYTES + 1] = ni >> 8;
+    shake256(b, 1, tmp, HAETAE_CRHBYTES + 2);
+  }
+
+  return ni;
+}