kpqc 0.1.0

data/vendor/NTRUplus/NTRU+768/fips202/fips202.h

@@ -0,0 +1,166 @@
+#ifndef FIPS202_H
+#define FIPS202_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define SHAKE128_RATE 168
+#define SHAKE256_RATE 136
+#define SHA3_256_RATE 136
+#define SHA3_384_RATE 104
+#define SHA3_512_RATE 72
+
+#define PQC_SHAKEINCCTX_BYTES (sizeof(uint64_t)*26)
+#define PQC_SHAKECTX_BYTES (sizeof(uint64_t)*25)
+
+// Context for incremental API
+typedef struct {
+    uint64_t ctx[26];
+} shake128incctx;
+
+// Context for non-incremental API
+typedef struct {
+    uint64_t ctx[25];
+} shake128ctx;
+
+// Context for incremental API
+typedef struct {
+    uint64_t ctx[26];
+} shake256incctx;
+
+// Context for non-incremental API
+typedef struct {
+    uint64_t ctx[25];
+} shake256ctx;
+
+// Context for incremental API
+typedef struct {
+    uint64_t ctx[26];
+} sha3_256incctx;
+
+// Context for incremental API
+typedef struct {
+    uint64_t ctx[26];
+} sha3_384incctx;
+
+// Context for incremental API
+typedef struct {
+    uint64_t ctx[26];
+} sha3_512incctx;
+
+/* Initialize the state and absorb the provided input.
+ *
+ * This function does not support being called multiple times
+ * with the same state.
+ */
+void shake128_absorb(shake128ctx *state, const uint8_t *input, size_t inlen);
+/* Squeeze output out of the sponge.
+ *
+ * Supports being called multiple times
+ */
+void shake128_squeezeblocks(uint8_t *output, size_t nblocks, shake128ctx *state);
+/* Free the state */
+void shake128_ctx_release(shake128ctx *state);
+/* Copy the state. */
+void shake128_ctx_clone(shake128ctx *dest, const shake128ctx *src);
+
+/* Initialize incremental hashing API */
+void shake128_inc_init(shake128incctx *state);
+/* Absorb more information into the XOF.
+ *
+ * Can be called multiple times.
+ */
+void shake128_inc_absorb(shake128incctx *state, const uint8_t *input, size_t inlen);
+/* Finalize the XOF for squeezing */
+void shake128_inc_finalize(shake128incctx *state);
+/* Squeeze output out of the sponge.
+ *
+ * Supports being called multiple times
+ */
+void shake128_inc_squeeze(uint8_t *output, size_t outlen, shake128incctx *state);
+/* Copy the context of the SHAKE128 XOF */
+void shake128_inc_ctx_clone(shake128incctx *dest, const shake128incctx *src);
+/* Free the context of the SHAKE128 XOF */
+void shake128_inc_ctx_release(shake128incctx *state);
+
+/* Initialize the state and absorb the provided input.
+ *
+ * This function does not support being called multiple times
+ * with the same state.
+ */
+void shake256_absorb(shake256ctx *state, const uint8_t *input, size_t inlen);
+/* Squeeze output out of the sponge.
+ *
+ * Supports being called multiple times
+ */
+void shake256_squeezeblocks(uint8_t *output, size_t nblocks, shake256ctx *state);
+/* Free the context held by this XOF */
+void shake256_ctx_release(shake256ctx *state);
+/* Copy the context held by this XOF */
+void shake256_ctx_clone(shake256ctx *dest, const shake256ctx *src);
+
+/* Initialize incremental hashing API */
+void shake256_inc_init(shake256incctx *state);
+void shake256_inc_absorb(shake256incctx *state, const uint8_t *input, size_t inlen);
+/* Prepares for squeeze phase */
+void shake256_inc_finalize(shake256incctx *state);
+/* Squeeze output out of the sponge.
+ *
+ * Supports being called multiple times
+ */
+void shake256_inc_squeeze(uint8_t *output, size_t outlen, shake256incctx *state);
+/* Copy the state */
+void shake256_inc_ctx_clone(shake256incctx *dest, const shake256incctx *src);
+/* Free the state */
+void shake256_inc_ctx_release(shake256incctx *state);
+
+/* One-stop SHAKE128 call */
+void shake128(uint8_t *output, size_t outlen,
+              const uint8_t *input, size_t inlen);
+
+/* One-stop SHAKE256 call */
+void shake256(uint8_t *output, size_t outlen,
+              const uint8_t *input, size_t inlen);
+
+/* Initialize the incremental hashing state */
+void sha3_256_inc_init(sha3_256incctx *state);
+/* Absorb blocks into SHA3 */
+void sha3_256_inc_absorb(sha3_256incctx *state, const uint8_t *input, size_t inlen);
+/* Obtain the output of the function and free `state` */
+void sha3_256_inc_finalize(uint8_t *output, sha3_256incctx *state);
+/* Copy the context */
+void sha3_256_inc_ctx_clone(sha3_256incctx *dest, const sha3_256incctx *src);
+/* Release the state, don't use if `_finalize` has been used */
+void sha3_256_inc_ctx_release(sha3_256incctx *state);
+
+void sha3_256(uint8_t *output, const uint8_t *input, size_t inlen);
+
+/* Initialize the incremental hashing state */
+void sha3_384_inc_init(sha3_384incctx *state);
+/* Absorb blocks into SHA3 */
+void sha3_384_inc_absorb(sha3_384incctx *state, const uint8_t *input, size_t inlen);
+/* Obtain the output of the function and free `state` */
+void sha3_384_inc_finalize(uint8_t *output, sha3_384incctx *state);
+/* Copy the context */
+void sha3_384_inc_ctx_clone(sha3_384incctx *dest, const sha3_384incctx *src);
+/* Release the state, don't use if `_finalize` has been used */
+void sha3_384_inc_ctx_release(sha3_384incctx *state);
+
+/* One-stop SHA3-384 shop */
+void sha3_384(uint8_t *output, const uint8_t *input, size_t inlen);
+
+/* Initialize the incremental hashing state */
+void sha3_512_inc_init(sha3_512incctx *state);
+/* Absorb blocks into SHA3 */
+void sha3_512_inc_absorb(sha3_512incctx *state, const uint8_t *input, size_t inlen);
+/* Obtain the output of the function and free `state` */
+void sha3_512_inc_finalize(uint8_t *output, sha3_512incctx *state);
+/* Copy the context */
+void sha3_512_inc_ctx_clone(sha3_512incctx *dest, const sha3_512incctx *src);
+/* Release the state, don't use if `_finalize` has been used */
+void sha3_512_inc_ctx_release(sha3_512incctx *state);
+
+/* One-stop SHA3-512 shop */
+void sha3_512(uint8_t *output, const uint8_t *input, size_t inlen);
+
+#endif

data/vendor/NTRUplus/NTRU+768/kem.c

@@ -0,0 +1,286 @@
+/* kpqc-py: propagate OS entropy failures (2026-09-06). */
+#include <stddef.h>
+#include <stdint.h>
+#include "api.h"
+#include "params.h"
+#include "symmetric.h"
+#include "poly.h"
+#include "fips202/fips202.h"
+#include "randombytes.h"
+
+/*************************************************
+* Name:        verify
+*
+* Description: Compares two byte arrays for equality in constant time.
+*
+* Arguments:   - const uint8_t *a: first byte array
+*              - const uint8_t *b: second byte array
+*              - size_t len:      length of the arrays
+*
+* Returns 0 if the arrays are equal, 1 otherwise.
+**************************************************/
+static inline int verify(const uint8_t *a, const uint8_t *b, size_t len)
+{
+    uint8_t acc = 0;
+
+    for (size_t i = 0; i < len; i++)
+        acc |= (uint8_t)(a[i] ^ b[i]);
+
+    return (-(uint64_t)acc) >> 63;
+}
+
+/*************************************************
+* Name:        genf_derand
+*
+* Description: Deterministically generates a secret polynomial f and its
+*              multiplicative inverse finv in the NTT domain.
+*
+* Arguments:   - poly *f:     output polynomial f (NTT domain)
+*              - poly *finv:  output multiplicative inverse of f
+*                              in the NTT domain
+*              - const uint8_t *coins: 32-byte deterministic seed
+*
+* Returns 0 on success; non-zero if f is not invertible in the NTT domain.
+**************************************************/
+static inline int genf_derand(poly *f, poly *finv, const uint8_t *coins)
+{
+    uint8_t buf[NTRUPLUS_N / 4];
+
+    shake256(buf, sizeof buf, coins, 32);
+
+    poly_cbd1(f, buf);
+    poly_triple(f, f);
+    f->coeffs[0] += 1;
+
+    poly_ntt(f);
+
+    return poly_baseinv(finv, f);
+}
+
+/*************************************************
+* Name:        geng_derand
+*
+* Description: Deterministically generates a secret polynomial g and its
+*              multiplicative inverse ginv in the NTT domain.
+*
+* Arguments:   - poly *g:      output polynomial g (NTT domain)
+*              - poly *ginv:   output multiplicative inverse of g
+*                               in the NTT domain
+*              - const uint8_t *coins: 32-byte deterministic seed
+*
+* Returns 0 on success; non-zero if g is not invertible in the NTT domain.
+**************************************************/
+static inline int geng_derand(poly *g, poly *ginv, const uint8_t *coins)
+{
+    uint8_t buf[NTRUPLUS_N / 4];
+
+    shake256(buf, sizeof buf, coins, 32);
+
+    poly_cbd1(g, buf);
+    poly_triple(g, g);
+
+    poly_ntt(g);
+
+    return poly_baseinv(ginv, g);
+}
+
+/*************************************************
+* Name:        crypto_kem_keypair_derand
+*
+* Description: Computes the deterministic public and secret key pair from
+*              the secret polynomials f and g and their multiplicative
+*              inverses finv and ginv in the NTT domain.
+*
+* Arguments:   - uint8_t *pk:   output public key
+*              - uint8_t *sk:   output secret key
+*              - const poly *f:     secret polynomial f (NTT domain)
+*              - const poly *finv:  multiplicative inverse of f (NTT domain)
+*              - const poly *g:     secret polynomial g (NTT domain)
+*              - const poly *ginv:  multiplicative inverse of g (NTT domain)
+*
+* Returns:     void
+**************************************************/
+static inline void crypto_kem_keypair_derand(uint8_t *pk, uint8_t *sk,
+                                             const poly *f,  const poly *finv,
+                                             const poly *g,  const poly *ginv)
+{
+    poly h, hinv;
+
+    poly_basemul(&h, g, finv);
+    poly_basemul(&hinv, f, ginv);
+
+    poly_tobytes(pk, &h);
+    poly_tobytes(sk, f);
+    poly_tobytes(sk + NTRUPLUS_POLYBYTES, &hinv);
+    hash_f(sk + 2 * NTRUPLUS_POLYBYTES, pk);
+}
+
+/*************************************************
+* Name:        crypto_kem_keypair
+*
+* Description: Generates an NTRU+ public/secret key pair for the
+*              CCA-secure key encapsulation mechanism. Secret
+*              polynomials f and g and their NTT-domain inverses
+*              are sampled internally using fresh randomness.
+*
+* Arguments:   - uint8_t *pk: output public key
+*                (array of CRYPTO_PUBLICKEYBYTES bytes)
+*              - uint8_t *sk: output secret key
+*                (array of CRYPTO_SECRETKEYBYTES bytes)
+*
+* Returns 0 on success.
+**************************************************/
+int crypto_kem_keypair(uint8_t *pk, uint8_t *sk)
+{
+    uint8_t coins[NTRUPLUS_SYMBYTES];
+
+    poly f, finv;
+    poly g, ginv;
+
+    do {
+        if (randombytes(coins, sizeof coins) != 0) return -1;
+    } while (genf_derand(&f, &finv, coins));
+
+    do {
+        if (randombytes(coins, sizeof coins) != 0) return -1;
+    } while (geng_derand(&g, &ginv, coins));
+
+    crypto_kem_keypair_derand(pk, sk, &f, &finv, &g, &ginv);
+    return 0;
+}
+
+/*************************************************
+* Name:        crypto_kem_enc_derand
+*
+* Description: Deterministically performs NTRU+ KEM encapsulation using
+*              the public key pk and the supplied randomness coins,
+*              producing a ciphertext ct and shared secret ss.
+*
+* Arguments:   - uint8_t *ct:      output ciphertext
+*              - uint8_t *ss:      output shared secret
+*              - const uint8_t *pk:    input public key
+*              - const uint8_t *coins: input randomness for
+*                                      deterministic encapsulation
+*
+* Returns 0 on success.
+**************************************************/
+static inline int crypto_kem_enc_derand(uint8_t *ct, uint8_t *ss,
+                                        const uint8_t *pk,
+                                        const uint8_t *coins)
+{
+	uint8_t msg[NTRUPLUS_N / 8 + NTRUPLUS_SYMBYTES];
+	uint8_t buf1[NTRUPLUS_SYMBYTES + NTRUPLUS_N / 4];
+	uint8_t buf2[NTRUPLUS_POLYBYTES];
+    
+    poly c, h, r, m;
+    
+    for (size_t i = 0; i < NTRUPLUS_N / 8; i++)
+        msg[i] = coins[i];
+
+    hash_f(msg + NTRUPLUS_N / 8, pk);
+    hash_h(buf1, msg);
+    
+    poly_cbd1(&r, buf1 + NTRUPLUS_SYMBYTES);
+    poly_ntt(&r);
+    
+    poly_tobytes(buf2, &r);
+    hash_g(buf2, buf2);
+    poly_sotp_encode(&m, msg, buf2);
+    poly_ntt(&m);
+    
+    poly_frombytes(&h, pk);
+    poly_basemul_add(&c, &h, &r, &m);
+    poly_tobytes(ct, &c);
+    
+    for (size_t i = 0; i < NTRUPLUS_SSBYTES; i++)
+        ss[i] = buf1[i];
+    
+    return 0;
+}
+
+/*************************************************
+* Name:        crypto_kem_enc
+*
+* Description: Generates an NTRU+ KEM ciphertext ct and shared secret ss
+*              using the public key pk. Fresh randomness is internally
+*              sampled and used for encapsulation.
+*
+* Arguments:   - uint8_t *ct: output ciphertext
+*                (array of CRYPTO_CIPHERTEXTBYTES bytes)
+*              - uint8_t *ss: output shared secret
+*                (array of CRYPTO_BYTES bytes)
+*              - const uint8_t *pk: input public key
+*                (array of CRYPTO_PUBLICKEYBYTES bytes)
+*
+* Returns 0 on success.
+**************************************************/
+int crypto_kem_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk)
+{
+    uint8_t coins[NTRUPLUS_N / 8];
+
+    if (randombytes(coins, sizeof coins) != 0) return -1;
+    return crypto_kem_enc_derand(ct, ss, pk, coins);
+}
+
+/*************************************************
+* Name:        crypto_kem_dec
+*
+* Description: Performs NTRU+ KEM decapsulation. Given a ciphertext ct
+*              and a secret key sk, computes the shared secret ss. If
+*              decapsulation fails, ss is set to all zero bytes.
+*
+* Arguments:   - uint8_t *ss:  output shared secret
+*                (array of CRYPTO_BYTES bytes)
+*              - const uint8_t *ct: input ciphertext
+*                (array of CRYPTO_CIPHERTEXTBYTES bytes)
+*              - const uint8_t *sk: input secret key
+*                (array of CRYPTO_SECRETKEYBYTES bytes)
+*
+* Returns 0 on success, 1 on failure.
+**************************************************/
+int crypto_kem_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk)
+{
+	uint8_t msg[NTRUPLUS_N / 8 + NTRUPLUS_SYMBYTES];
+	uint8_t buf1[NTRUPLUS_POLYBYTES];
+	uint8_t buf2[NTRUPLUS_POLYBYTES];
+	uint8_t buf3[NTRUPLUS_POLYBYTES + NTRUPLUS_SYMBYTES];
+    
+    int8_t fail;
+    
+    poly c, f, hinv;
+    poly r1, r2;
+    poly m1, m2;
+    
+    poly_frombytes(&c, ct);
+    poly_frombytes(&f, sk);
+    poly_frombytes(&hinv, sk + NTRUPLUS_POLYBYTES);
+    
+    poly_basemul(&m1, &c, &f);
+    poly_invntt(&m1);
+    poly_crepmod3(&m1, &m1);
+    
+    m2 = m1;
+    poly_ntt(&m2);
+    poly_sub(&c, &c, &m2);
+    poly_basemul(&r2, &c, &hinv);
+
+    poly_tobytes(buf1, &r2);
+    hash_g(buf2, buf1);
+    fail = poly_sotp_decode(msg, &m1, buf2);
+    
+    for (size_t i = 0; i < NTRUPLUS_SYMBYTES; i++)
+        msg[i + NTRUPLUS_N / 8] = sk[i + 2 * NTRUPLUS_POLYBYTES];
+    
+    hash_h(buf3, msg);
+    
+    poly_cbd1(&r1, buf3 + NTRUPLUS_SSBYTES);
+    poly_ntt(&r1);
+    poly_tobytes(buf2, &r1);
+    
+    fail |= verify(buf1, buf2, NTRUPLUS_POLYBYTES);
+    
+    for (size_t i = 0; i < NTRUPLUS_SSBYTES; i++)
+        ss[i] = buf3[i] & ~(-fail);
+    
+    return fail;
+}