kpqc 0.1.0

data/vendor/NTRUplus/NTRU+864/poly.c

@@ -0,0 +1,314 @@
+#include <stdint.h>
+#include <string.h>
+#include "params.h"
+#include "poly.h"
+#include "ntt.h"
+#include "symmetric.h"
+
+/*************************************************
+* Name:        crepmod3
+*
+* Description: Compute modulus 3 operation
+*
+* Arguments: - poly *a: pointer to intput integer to be reduced
+*
+* Returns:     integer in {-1,0,1} congruent to a modulo 3.
+**************************************************/
+static inline int16_t crepmod3(int16_t a)
+{
+	int16_t t;
+	const int16_t v = ((1<<15) + 3/2)/3;
+
+	a += (a >> 15) & NTRUPLUS_Q;
+	a -= (NTRUPLUS_Q+1)/2;
+	a += (a >> 15) & NTRUPLUS_Q;
+	a -= (NTRUPLUS_Q-1)/2;
+
+	t  = ((int32_t)v*a + (1<<14)) >> 15;
+	t *= 3;
+	return a - t;
+}
+
+/*************************************************
+* Name:        poly_tobytes
+*
+* Description: Serialization of a polynomial
+*
+* Arguments:   - uint8_t *r: pointer to output byte array
+*                            (needs space for NTRUPLUS_POLYBYTES bytes)
+*              - poly *a:    pointer to input polynomial
+**************************************************/
+void poly_tobytes(uint8_t r[NTRUPLUS_POLYBYTES], const poly *a)
+{
+	int16_t t[2];
+
+	#pragma GCC unroll 2
+	for(size_t i = 0; i < NTRUPLUS_N/2; i++)
+	{
+		t[0] = a->coeffs[2*i];
+		t[0] += (t[0] >> 15) & NTRUPLUS_Q;
+		t[1] = a->coeffs[2*i+1];
+		t[1] += (t[1] >> 15) & NTRUPLUS_Q;
+
+		r[3*i+0] = (t[0] >> 0);
+		r[3*i+1] = (t[0] >> 8) | (t[1] << 4);
+		r[3*i+2] = (t[1] >> 4);
+	}
+}
+
+/*************************************************
+* Name:        poly_frombytes
+*
+* Description: De-serialization of a polynomial;
+*              inverse of poly_tobytes
+*
+* Arguments:   - poly *r:          pointer to output polynomial
+*              - const uint8_t *a: pointer to input byte array
+*                                  (of NTRUPLUS_POLYBYTES bytes)
+**************************************************/
+void poly_frombytes(poly *r, const uint8_t a[NTRUPLUS_POLYBYTES])
+{
+	for(size_t i = 0; i < NTRUPLUS_N/2; i++)
+	{
+		r->coeffs[2*i]   = ((a[3*i+0] >> 0) | ((uint16_t)a[3*i+1] << 8)) & 0xFFF;
+		r->coeffs[2*i+1] = ((a[3*i+1] >> 4) | ((uint16_t)a[3*i+2] << 4)) & 0xFFF;
+	}
+}
+
+/*************************************************
+* Name:        poly_cbd1
+*
+* Description: Sample a polynomial deterministically from a random,
+*              with output polynomial close to centered binomial distribution
+*
+* Arguments:   - poly *r: pointer to output polynomial
+*              - const uint8_t *buf: pointer to input random
+*                                     (of length NTRUPLUS_N/4 bytes)
+**************************************************/
+void poly_cbd1(poly *r, const unsigned char buf[NTRUPLUS_N/4])
+{
+	uint8_t t1, t2;
+
+	for(size_t i = 0; i < NTRUPLUS_N / 8; i++)
+	{
+		t1 = buf[i];
+		t2 = buf[i + NTRUPLUS_N / 8];
+
+		for(size_t j = 0; j < 8; j++)
+		{
+			r->coeffs[8*i + j] = (t1 & 0x1) - (t2 & 0x1);
+
+			t1 >>= 1;   
+			t2 >>= 1;
+		}
+	}
+}
+
+/*************************************************
+* Name:        poly_sotp_encode
+*
+* Description: Encode a message deterministically using SOTP and a random,
+			   with output polynomial close to centered binomial distribution
+*
+* Arguments:   - poly *r: pointer to output polynomial
+*              - const uint8_t *msg: pointer to input message
+*              - const uint8_t *buf: pointer to input random
+**************************************************/
+void poly_sotp_encode(poly *r, const uint8_t msg[NTRUPLUS_N/8], const uint8_t buf[NTRUPLUS_N/4])
+{
+    uint8_t tmp[NTRUPLUS_N/4];
+
+    for(int i = 0; i < NTRUPLUS_N/8; i++)
+    {
+         tmp[i] = buf[i]^msg[i];
+    }
+
+    for(int i = NTRUPLUS_N/8; i < NTRUPLUS_N/4; i++)
+    {
+         tmp[i] = buf[i];
+    }
+
+	poly_cbd1(r, tmp);
+}
+
+/*************************************************
+* Name:        poly_sotp_decode
+*
+* Description: Decode a message deterministically using SOTP_INV and a random
+*
+* Arguments:   - uint8_t *msg: pointer to output message
+*              - const poly *a: pointer to iput polynomial
+*              - const uint8_t *buf: pointer to input random
+*
+* Returns 0 (success) or 1 (failure)
+**************************************************/
+int poly_sotp_decode(uint8_t msg[NTRUPLUS_N/8], const poly *a, const uint8_t buf[NTRUPLUS_N/4])
+{
+	uint8_t t1, t2, t3;
+	uint16_t t4;
+	uint32_t r = 0;
+
+	for(size_t i = 0; i < NTRUPLUS_N / 8; i++)
+	{
+		t1 = buf[i                 ];
+		t2 = buf[i + NTRUPLUS_N / 8];
+		t3 = 0;
+
+		for(int j = 0; j < 8; j++)
+		{
+			t4 = t2 & 0x1;
+			t4 += a->coeffs[8*i + j];
+			r |= t4;
+			t4 = (t4 ^ t1) & 0x1;
+			t3 ^= (uint8_t)(t4 << j);
+
+			t1 >>= 1;
+			t2 >>= 1;
+		}
+
+		msg[i] = t3;
+	}
+
+	r = r >> 1;
+	r = (-(uint32_t)r) >> 31;
+
+	return r;
+}
+
+/*************************************************
+* Name:        poly_ntt
+*
+* Description: Computes number-theoretic transform (NTT)
+*
+* Arguments:   - poly *r: pointer to input/output polynomial
+**************************************************/
+void poly_ntt(poly *r)
+{
+	ntt(r->coeffs);
+}
+
+/*************************************************
+* Name:        poly_invntt
+*
+* Description: Computes inverse of number-theoretic transform (NTT)
+*
+* Arguments:   - poly *r: pointer to input/output polynomial
+**************************************************/
+void poly_invntt(poly *r)
+{
+	invntt(r->coeffs);
+}
+
+/*************************************************
+* Name:        poly_baseinv
+*
+* Description: Inversion of polynomial in NTT domain
+*
+* Arguments:   - poly *r:       pointer to output polynomial
+*              - const poly *a: pointer to input polynomial
+* 
+* Returns:     integer
+**************************************************/
+int poly_baseinv(poly *r, const poly *a)
+{
+	for(int i = 0; i < NTRUPLUS_N/6; ++i)
+	{
+		if(baseinv(r->coeffs+6*i, a->coeffs+6*i, zetas[144+i]))
+		{
+			for (size_t j = 0; j < NTRUPLUS_N; ++j)
+				r->coeffs[j] = 0;
+
+			return 1;
+		}
+
+		if(baseinv(r->coeffs+6*i+3, a->coeffs+6*i+3, -zetas[144+i]))
+		{
+			for (size_t j = 0; j < NTRUPLUS_N; ++j)
+				r->coeffs[j] = 0;
+
+			return 1;
+		}
+	 }
+
+	return 0;
+}
+
+/*************************************************
+* Name:        poly_basemul
+*
+* Description: Multiplication of two polynomials in NTT domain
+*
+* Arguments:   - poly *r:       pointer to output polynomial
+*              - const poly *a: pointer to first input polynomial
+*              - const poly *b: pointer to second input polynomial
+**************************************************/
+void poly_basemul(poly *r, const poly *a, const poly *b)
+{
+	for(int i = 0; i < NTRUPLUS_N/6; i++)
+	{
+		basemul(r->coeffs+6*i,   a->coeffs+6*i,   b->coeffs+6*i,    zetas[144+i]);
+		basemul(r->coeffs+6*i+3, a->coeffs+6*i+3, b->coeffs+6*i+3, -zetas[144+i]);
+	}
+}
+
+/*************************************************
+* Name:        poly_basemul_add
+*
+* Description: Multiplication then addition of three polynomials in NTT domain
+*
+* Arguments:   - poly *r:       pointer to output polynomial
+*              - const poly *a: pointer to first input polynomial
+*              - const poly *b: pointer to second input polynomial
+*              - const poly *c: pointer to third input polynomial
+**************************************************/
+void poly_basemul_add(poly *r, const poly *a, const poly *b, const poly *c)
+{
+	for(int i = 0; i < NTRUPLUS_N/6; i++)
+	{
+		basemul_add(r->coeffs+6*i,   a->coeffs+6*i,   b->coeffs+6*i,   c->coeffs+6*i,    zetas[144+i]);
+		basemul_add(r->coeffs+6*i+3, a->coeffs+6*i+3, b->coeffs+6*i+3, c->coeffs+6*i+3, -zetas[144+i]);
+	}
+}
+
+/*************************************************
+* Name:        poly_sub
+*
+* Description: Subtract two polynomials; no modular reduction is performed
+*
+* Arguments: - poly *r: pointer to output polynomial
+*            - const poly *a: pointer to first input polynomial
+*            - const poly *b: pointer to second input polynomial
+**************************************************/
+void poly_sub(poly *r, const poly *a, const poly *b)
+{
+	for(int i = 0; i < NTRUPLUS_N; ++i)
+		r->coeffs[i] = a->coeffs[i] - b->coeffs[i];
+}
+
+/*************************************************
+* Name:        poly_triple
+*
+* Description: Multiply polynomial by 3; no modular reduction is performed
+*
+* Arguments: - poly *r: pointer to output polynomial
+*            - const poly *a: pointer to input polynomial
+**************************************************/
+void poly_triple(poly *r, const poly *a) 
+{
+	for(int i = 0; i < NTRUPLUS_N; ++i)
+		r->coeffs[i] = 3*a->coeffs[i];
+}
+
+/*************************************************
+* Name:        poly_crepmod3
+*
+* Description: Compute modulus 3 operation to polynomial
+*
+* Arguments: - poly *r: pointer to output polynomial
+*            - const poly *a: pointer to input polynomial
+**************************************************/
+void poly_crepmod3(poly *r, const poly *a)
+{
+	for(int i = 0; i < NTRUPLUS_N; i++)
+		r->coeffs[i] = crepmod3(a->coeffs[i]);
+}

data/vendor/NTRUplus/NTRU+864/poly.h

@@ -0,0 +1,31 @@
+#ifndef POLY_H
+#define POLY_H
+
+#include <stdint.h>
+#include "params.h"
+
+/*
+ * Elements of R_q = Z_q[X]/(X^n - X^n/2 + 1). Represents polynomial
+ * coeffs[0] + X*coeffs[1] + X^2*xoeffs[2] + ... + X^{n-1}*coeffs[n-1]
+ */
+typedef struct{
+	int16_t coeffs[NTRUPLUS_N];
+} poly;
+
+void poly_tobytes(uint8_t r[NTRUPLUS_POLYBYTES], const poly *a);
+void poly_frombytes(poly *r, const uint8_t a[NTRUPLUS_POLYBYTES]);
+
+void poly_cbd1(poly *r, const uint8_t buf[NTRUPLUS_N/4]);
+void poly_sotp_encode(poly *r, const uint8_t msg[NTRUPLUS_N/8], const uint8_t buf[NTRUPLUS_N/4]);
+int  poly_sotp_decode(uint8_t msg[NTRUPLUS_N/8], const poly *a, const uint8_t buf[NTRUPLUS_N/4]);
+
+void poly_ntt(poly *r);
+void poly_invntt(poly *r);
+int  poly_baseinv(poly *r, const poly *a);
+void poly_basemul(poly *r, const poly *a, const poly *b);
+void poly_basemul_add(poly *r, const poly *a, const poly *b, const poly *c);
+void poly_sub(poly *r, const poly *a, const poly *b);
+void poly_triple(poly *r, const poly *a);
+void poly_crepmod3(poly *r, const poly *a);
+
+#endif

data/vendor/NTRUplus/NTRU+864/randombytes.h

@@ -0,0 +1,9 @@
+#ifndef RANDOMBYTES_H
+#define RANDOMBYTES_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+int randombytes(uint8_t *out, size_t outlen);
+
+#endif

data/vendor/NTRUplus/NTRU+864/symmetric.c

@@ -0,0 +1,39 @@
+#include <string.h>
+#include "symmetric.h"
+#include "fips202/fips202.h"
+
+#define HASH_F_INBYTES  (NTRUPLUS_POLYBYTES)
+#define HASH_F_OUTBYTES (32)
+
+#define HASH_G_INBYTES  (NTRUPLUS_POLYBYTES)
+#define HASH_G_OUTBYTES (NTRUPLUS_N / 4)
+
+#define HASH_H_INBYTES  (NTRUPLUS_N / 8 + NTRUPLUS_SYMBYTES)
+#define HASH_H_OUTBYTES (NTRUPLUS_SSBYTES + NTRUPLUS_N / 4)
+
+void hash_f(uint8_t *buf, const uint8_t *msg)
+{
+    uint8_t data[1 + HASH_F_INBYTES];
+
+    data[0] = 0x00;
+    memcpy(data + 1, msg, HASH_F_INBYTES);
+    shake256(buf, HASH_F_OUTBYTES, data, HASH_F_INBYTES + 1);
+}
+
+void hash_g(uint8_t *buf, const uint8_t *msg)
+{
+    uint8_t data[1 + HASH_G_INBYTES];
+
+    data[0] = 0x01;
+    memcpy(data + 1, msg, HASH_G_INBYTES);
+    shake256(buf, HASH_G_OUTBYTES, data, HASH_G_INBYTES + 1);
+}
+
+void hash_h(uint8_t *buf, const uint8_t *msg)
+{
+    uint8_t data[1 + HASH_H_INBYTES];
+
+    data[0] = 0x02;
+    memcpy(data + 1, msg, HASH_H_INBYTES);
+    shake256(buf, HASH_H_OUTBYTES, data, HASH_H_INBYTES + 1);
+}

data/vendor/NTRUplus/NTRU+864/symmetric.h

@@ -0,0 +1,12 @@
+#ifndef SYMMETRIC_H
+#define SYMMETRIC_H
+
+#include <stddef.h>
+#include <stdint.h>
+#include "params.h"
+
+void hash_f(uint8_t *buf, const uint8_t *msg);
+void hash_g(uint8_t *buf, const uint8_t *msg);
+void hash_h(uint8_t *buf, const uint8_t *msg);
+
+#endif /* SYMMETRIC_H */

data/vendor/SMAUG-T/LICENSE

@@ -0,0 +1,22 @@
+Copyright (c) 2026 Team SMAUG-T
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.

data/vendor/SMAUG-T/include/api.h

@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_API_H
+#define SMAUGT_API_H
+
+#include "params.h"
+
+#include <stdint.h>
+
+/* Export API in SUPERCOP naming scheme CRYPTO_xxx / crypto_kem_xxx */
+#define CRYPTO_SECRETKEYBYTES SMAUGT_KEM_SECRETKEY_BYTES
+#define CRYPTO_PUBLICKEYBYTES SMAUGT_PUBLICKEY_BYTES
+#define CRYPTO_CIPHERTEXTBYTES SMAUGT_CIPHERTEXT_BYTES
+#define CRYPTO_BYTES SMAUGT_SHARED_SECRETE_BYTES
+#define CRYPTO_ALGNAME SMAUGT_CRYPTO_ALGNAME
+
+#define crypto_kem_keypair_internal SMAUGT_NAMESPACE(keypair_internal)
+#define crypto_kem_keypair SMAUGT_NAMESPACE(keypair)
+#define crypto_kem_enc_internal SMAUGT_NAMESPACE(enc_internal)
+#define crypto_kem_enc SMAUGT_NAMESPACE(enc)
+#define crypto_kem_dec_internal SMAUGT_NAMESPACE(dec_internal)
+#define crypto_kem_dec SMAUGT_NAMESPACE(dec)
+
+int crypto_kem_keypair_internal(uint8_t *pk, uint8_t *sk,
+                                uint8_t d[SMAUGT_T_BYTES],
+                                uint8_t seed[SMAUGT_CRYPTO_BYTES]);
+int crypto_kem_keypair(uint8_t *pk, uint8_t *sk);
+
+int crypto_kem_enc_internal(uint8_t *ctxt, uint8_t *ss, const uint8_t *pk,
+                            const uint8_t *mu);
+int crypto_kem_enc(uint8_t *ctxt, uint8_t *ss, const uint8_t *pk);
+
+int crypto_kem_dec_internal(uint8_t *ss, const uint8_t *ctxt,
+                            const uint8_t *sk);
+int crypto_kem_dec(uint8_t *ss, const uint8_t *ctxt, const uint8_t *sk);
+
+#endif /* !SMAUGT_API_H */

data/vendor/SMAUG-T/include/cbd.h

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_CBD_H
+#define SMAUGT_CBD_H
+
+#include "params.h"
+#include "poly.h"
+
+#include <stdint.h>
+
+#define sp_cbd SMAUGT_NAMESPACE(sp_cbd)
+
+void sp_cbd(poly *r, const uint8_t buf[SMAUGT_CBDSEED_BYTES]);
+
+#endif /* !SMAUGT_CBD_H */

data/vendor/SMAUG-T/include/ciphertext.h

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_CIPHERTEXT_H
+#define SMAUGT_CIPHERTEXT_H
+
+#include "params.h"
+#include "poly.h"
+
+#include <stdint.h>
+
+#if SMAUGT_MODE == SMAUGT_MODE1
+#define SMAUGT_RD_ADD 0x80    // 2^(15 - SMAUGT_LOG_P)
+#define SMAUGT_RD_AND 0xff00  // 2^16 - 2^(16 - SMAUGT_LOG_P)
+#define SMAUGT_RD_ADD2 0x0400 // 2^(15 - SMAUGT_LOG_P_PRIME)
+#define SMAUGT_RD_AND2 0xf800 // 2^16 - 2^(16 - SMAUGT_LOG_P_PRIME)
+#elif SMAUGT_MODE == SMAUGT_MODE3
+#define SMAUGT_RD_ADD 0x40    // 2^(15 - SMAUGT_LOG_P)
+#define SMAUGT_RD_AND 0xff80  // 2^16 - 2^(16 - SMAUGT_LOG_P)
+#define SMAUGT_RD_ADD2 0x0800 // 2^(15 - SMAUGT_LOG_P_PRIME)
+#define SMAUGT_RD_AND2 0xf000 // 2^16 - 2^(16 - SMAUGT_LOG_P_PRIME)
+#elif SMAUGT_MODE == SMAUGT_MODE5
+#define SMAUGT_RD_ADD 0x40    // 2^(15 - SMAUGT_LOG_P)
+#define SMAUGT_RD_AND 0xff80  // 2^16 - 2^(16 - SMAUGT_LOG_P)
+#define SMAUGT_RD_ADD2 0x0100 // 2^(15 - SMAUGT_LOG_P_PRIME)
+#define SMAUGT_RD_AND2 0xfe00 // 2^16 - 2^(16 - SMAUGT_LOG_P_PRIME)
+#elif SMAUGT_MODE == SMAUGT_MODET
+#define SMAUGT_RD_ADD 0x80    // 2^(15 - SMAUGT_LOG_P)
+#define SMAUGT_RD_AND 0xff00  // 2^16 - 2^(16 - SMAUGT_LOG_P)
+#define SMAUGT_RD_ADD2 0x1000 // 2^(15 - SMAUGT_LOG_P_PRIME)
+#define SMAUGT_RD_AND2 0xe000 // 2^16 - 2^(16 - SMAUGT_LOG_P_PRIME)
+#endif
+
+typedef struct Ciphertext {
+    polyvec c1;
+    poly c2;
+} ciphertext;
+
+#define computeC1 SMAUGT_NAMESPACE(computeC1)
+#define computeC2 SMAUGT_NAMESPACE(computeC2)
+
+void computeC1(polyvec *c1, const polyvec A[SMAUGT_K], const polyvec *r);
+void computeC2(poly *c2, const uint8_t mu[SMAUGT_MSG_BYTES], const polyvec *b,
+               const polyvec *r);
+
+#endif /* !SMAUGT_CIPHERTEXT_H */

data/vendor/SMAUG-T/include/common.h

@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_COMMON_H
+#define SMAUGT_COMMON_H
+
+#define SMAUGT_CONCAT_(x1, x2) x1##x2
+#define SMAUGT_CONCAT(x1, x2) SMAUGT_CONCAT_(x1, x2)
+
+#define SMAUGT_STR_(x) #x
+#define SMAUGT_STR(x) SMAUGT_STR_(x)
+
+#endif /* !SMAUGT_COMMON_H */

data/vendor/SMAUG-T/include/config.h

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_CONFIG_H
+#define SMAUGT_CONFIG_H
+
+#include "common.h"
+
+#define SMAUGT_MODE1 0
+#define SMAUGT_MODE3 1
+#define SMAUGT_MODE5 2
+#define SMAUGT_MODET 3
+
+#if !defined(SMAUGT_CONFIG_MODE)
+#define SMAUGT_CONFIG_MODE SMAUGT_MODE1
+#endif
+
+#if (SMAUGT_CONFIG_MODE != SMAUGT_MODE1) &&                                    \
+    (SMAUGT_CONFIG_MODE != SMAUGT_MODE3) &&                                    \
+    (SMAUGT_CONFIG_MODE != SMAUGT_MODE5) &&                                    \
+    (SMAUGT_CONFIG_MODE != SMAUGT_MODET)
+#error "Invalid SMAUGT_CONFIG_MODE"
+#endif
+
+#if !defined(SMAUGT_CONFIG_MODE_STRING)
+
+#if SMAUGT_CONFIG_MODE == SMAUGT_MODE1
+#define SMAUGT_CONFIG_MODE_STRING mode1
+#elif SMAUGT_CONFIG_MODE == SMAUGT_MODE3
+#define SMAUGT_CONFIG_MODE_STRING mode3
+#elif SMAUGT_CONFIG_MODE == SMAUGT_MODE5
+#define SMAUGT_CONFIG_MODE_STRING mode5
+#elif SMAUGT_CONFIG_MODE == SMAUGT_MODET
+#define SMAUGT_CONFIG_MODE_STRING modet
+#endif
+
+#endif
+
+#if !defined(SMAUGT_CONFIG_NAMESPACE_PREFIX)
+#define SMAUGT_CONFIG_NAMESPACE_PREFIX cryptolab_smaugt_
+#endif
+
+#if !defined(SMAUGT_CONFIG_NAMESPACE_PREFIX_MODE)
+#define SMAUGT_ADD_MODE(s) SMAUGT_CONCAT(s, SMAUGT_CONFIG_MODE_STRING)
+#define SMAUGT_CONFIG_NAMESPACE_PREFIX_MODE                                    \
+    SMAUGT_CONCAT(SMAUGT_ADD_MODE(SMAUGT_CONFIG_NAMESPACE_PREFIX), _)
+#endif
+
+#endif /* !SMAUGT_CONFIG_H */

data/vendor/SMAUG-T/include/dg.h

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_DG_H
+#define SMAUGT_DG_H
+
+#include "params.h"
+#include "poly.h"
+
+#include <stdint.h>
+
+// error distribution for LWE instances in public key generation:
+// store probability table (CDF_TABLE)
+// sample a single error from (SMAUGT_DG_RAND_BITS)-length of random binary
+// string A discrete error distribution close to the discrete Gaussian
+// distribution
+#define SMAUGT_DG_RAND_BITS 10 // bits for RND + SIGN
+#define SMAUGT_DG_SMAUGT_SLEN 2
+#define SMAUGT_DG_SMAUGT_SEED_LEN                                              \
+    (SMAUGT_DG_RAND_BITS * SMAUGT_N / 64) // 64-bit seed length
+
+#define d_gaussian_poly SMAUGT_NAMESPACE(d_gaussian_poly)
+#define d_gaussian SMAUGT_NAMESPACE(d_gaussian)
+
+int d_gaussian_poly(poly *op, const uint8_t *seed);
+
+void d_gaussian(polyvec *op, const uint8_t seed[SMAUGT_CRYPTO_BYTES]);
+
+#endif /* !SMAUGT_DG_H */

data/vendor/SMAUG-T/include/fips202.h

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_FIPS202_H
+#define SMAUGT_FIPS202_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define SHAKE128_RATE 168
+#define SHAKE256_RATE 136
+#define SHA3_256_RATE 136
+#define SHA3_512_RATE 72
+
+#define SHA3_256_HashSize 32
+#define SHA3_512_HashSize 64
+
+typedef struct {
+    uint64_t s[25];
+    unsigned int pos;
+} keccak_state;
+
+void shake128_init(keccak_state *state);
+void shake128_absorb(keccak_state *state, const uint8_t *in, size_t inlen);
+void shake128_finalize(keccak_state *state);
+void shake128_squeeze(uint8_t *out, size_t outlen, keccak_state *state);
+void shake128_absorb_once(keccak_state *state, const uint8_t *in, size_t inlen);
+void shake128_squeezeblocks(uint8_t *out, size_t nblocks, keccak_state *state);
+
+void shake256_init(keccak_state *state);
+void shake256_absorb(keccak_state *state, const uint8_t *in, size_t inlen);
+void shake256_finalize(keccak_state *state);
+void shake256_squeeze(uint8_t *out, size_t outlen, keccak_state *state);
+void shake256_absorb_once(keccak_state *state, const uint8_t *in, size_t inlen);
+void shake256_squeezeblocks(uint8_t *out, size_t nblocks, keccak_state *state);
+
+void shake128(uint8_t *out, size_t outlen, const uint8_t *in, size_t inlen);
+void shake256(uint8_t *out, size_t outlen, const uint8_t *in, size_t inlen);
+void sha3_256(uint8_t h[32], const uint8_t *in, size_t inlen);
+void sha3_512(uint8_t h[64], const uint8_t *in, size_t inlen);
+
+#endif /* !SMAUGT_FIPS202_H */

data/vendor/SMAUG-T/include/hash.h

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_HASH_H
+#define SMAUGT_HASH_H
+
+#include "params.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define hash_h(OUT, IN, INLEN) sha3_256(OUT, IN, INLEN)
+#define hash_g(OUT, OUTLEN, IN1, INLEN1, IN2, INLEN2)                          \
+    shake256_absorb_twice_squeeze(OUT, OUTLEN, IN1, INLEN1, IN2, INLEN2)
+#define shake256_absorb_twice_squeeze                                          \
+    SMAUGT_NAMESPACE(shake256_absorb_twice_squeeze)
+
+void shake256_absorb_twice_squeeze(uint8_t *out, size_t outlen,
+                                   const uint8_t *in1, size_t inlen1,
+                                   const uint8_t *in2, size_t inlen2);
+
+#endif /* !SMAUGT_HASH_H */