kpqc 0.1.0

data/vendor/SMAUG-T/include/hwt.h

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_HWT_H
+#define SMAUGT_HWT_H
+
+#include "params.h"
+
+#include <stdint.h>
+
+// https://github.com/dgazzoni/NTRU-sampling/blob/main/jupyter/NTRU-sampling.ipynb
+// Use enough seed size 308
+#define SMAUGT_HWTSEEDBYTES ((16 * 308) / 8)
+
+// Hamming weight of coefficient vector s
+#if SMAUGT_MODE == SMAUGT_MODE1
+#define SMAUGT_HS 70
+#elif SMAUGT_MODE == SMAUGT_MODE3
+#define SMAUGT_HS 88
+#elif SMAUGT_MODE == SMAUGT_MODE5
+#define SMAUGT_HS 87
+#elif SMAUGT_MODE == SMAUGT_MODET
+#define SMAUGT_HS 70
+#endif
+
+#define hwt SMAUGT_NAMESPACE(hwt)
+int hwt(int16_t *res, const uint8_t *seed);
+
+#endif /* !SMAUGT_HWT_H */

data/vendor/SMAUG-T/include/indcpa.h

@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_INDCPA_H
+#define SMAUGT_INDCPA_H
+
+#include "params.h"
+#include "poly.h"
+
+#include <stdint.h>
+
+#define SMAUGT_DEC_ADD 0x4000 // 2^(15 - SMAUGT_LOG_T)
+
+#define expand_r SMAUGT_NAMESPACE(expand_r)
+#define indcpa_keypair SMAUGT_NAMESPACE(indcpa_keypair)
+#define indcpa_enc SMAUGT_NAMESPACE(indcpa_enc)
+#define indcpa_dec SMAUGT_NAMESPACE(indcpa_dec)
+
+void expand_r(polyvec *r, const uint8_t *seed);
+
+void indcpa_keypair(uint8_t pk[SMAUGT_PUBLICKEY_BYTES],
+                    uint8_t sk[SMAUGT_PKE_SECRETKEY_BYTES],
+                    const uint8_t seed[SMAUGT_CRYPTO_BYTES]);
+
+void indcpa_enc(uint8_t ctxt[SMAUGT_CIPHERTEXT_BYTES],
+                const uint8_t pk[SMAUGT_PUBLICKEY_BYTES],
+                const uint8_t mu[SMAUGT_MSG_BYTES],
+                const uint8_t seed[SMAUGT_DELTA_BYTES]);
+
+void indcpa_dec(uint8_t mu[SMAUGT_MSG_BYTES],
+                const uint8_t sk[SMAUGT_PKE_SECRETKEY_BYTES],
+                const uint8_t ctxt[SMAUGT_CIPHERTEXT_BYTES]);
+
+#endif /* !SMAUGT_INDCPA_H */

data/vendor/SMAUG-T/include/key.h

@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_KEY_H
+#define SMAUGT_KEY_H
+
+#include "poly.h"
+
+#include <stdint.h>
+
+typedef polyvec secret_key;
+
+typedef struct PublicKey {
+    uint8_t seed[SMAUGT_PKSEED_BYTES];
+    polyvec A[SMAUGT_K];
+    polyvec b;
+} public_key;
+
+#define expand_A SMAUGT_NAMESPACE(expand_A)
+#define expand_b SMAUGT_NAMESPACE(expand_b)
+#define expand_s SMAUGT_NAMESPACE(expand_s)
+#define gen_pub_key SMAUGT_NAMESPACE(gen_pub_key)
+
+void expand_A(polyvec A[SMAUGT_K],
+              const unsigned char seed[SMAUGT_PKSEED_BYTES]);
+
+void expand_b(polyvec *b, const polyvec A[SMAUGT_K], const polyvec *s,
+              const uint8_t e_seed[SMAUGT_CRYPTO_BYTES]);
+
+void expand_s(secret_key *sk, const uint8_t seed[SMAUGT_CRYPTO_BYTES]);
+
+void gen_pub_key(public_key *pk, const secret_key *sk,
+                 const uint8_t err_seed[SMAUGT_CRYPTO_BYTES]);
+
+#endif /* !SMAUGT_KEY_H */

data/vendor/SMAUG-T/include/pack.h

@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_PACK_H
+#define SMAUGT_PACK_H
+
+#include "ciphertext.h"
+#include "key.h"
+#include "params.h"
+#include "poly.h"
+
+#include <stdint.h>
+
+#define pack_enck SMAUGT_NAMESPACE(pack_enck)
+#define unpack_enck SMAUGT_NAMESPACE(unpack_enck)
+
+#define pack_deck SMAUGT_NAMESPACE(pack_deck)
+#define unpack_deck SMAUGT_NAMESPACE(unpack_deck)
+
+#define pack_s_poly SMAUGT_NAMESPACE(pack_s_poly)
+#define unpack_s_poly SMAUGT_NAMESPACE(unpack_s_poly)
+
+#define pack_ct SMAUGT_NAMESPACE(pack_ct)
+#define unpack_ct SMAUGT_NAMESPACE(unpack_ct)
+
+#define pack_ring SMAUGT_NAMESPACE(pack_ring)
+#define unpack_ring SMAUGT_NAMESPACE(unpack_ring)
+
+#define pack_ring_p SMAUGT_NAMESPACE(pack_ring_p)
+#define unpack_ring_p SMAUGT_NAMESPACE(unpack_ring_p)
+
+#define pack_ring_p_prime SMAUGT_NAMESPACE(pack_ring_p_prime)
+#define unpack_ring_p_prime SMAUGT_NAMESPACE(unpack_ring_p_prime)
+
+#define pack_ring_vec SMAUGT_NAMESPACE(pack_ring_vec)
+#define unpack_ring_vec SMAUGT_NAMESPACE(unpack_ring_vec)
+
+#define pack_ring_p_vec SMAUGT_NAMESPACE(pack_ring_p_vec)
+#define unpack_ring_p_vec SMAUGT_NAMESPACE(unpack_ring_p_vec)
+
+#define pack_ring_mat SMAUGT_NAMESPACE(pack_ring_mat)
+#define unpack_ring_mat SMAUGT_NAMESPACE(unpack_ring_mat)
+
+void pack_enck(uint8_t *output, const public_key *pk);
+void unpack_enck(public_key *pk, const uint8_t *input);
+
+void pack_deck(uint8_t *output, const secret_key *sk);
+void unpack_deck(secret_key *sk, const uint8_t *input);
+
+void pack_s_poly(uint8_t *bytes, const poly *data);
+void unpack_s_poly(poly *data, const uint8_t *bytes);
+
+void pack_ct(uint8_t *output, const ciphertext *ctxt);
+void unpack_ct(ciphertext *ctxt, const uint8_t *input);
+
+void pack_ring(uint8_t bytes[SMAUGT_PKPOLY_BYTES], const poly *data);
+void unpack_ring(poly *data, const uint8_t bytes[SMAUGT_PKPOLY_BYTES]);
+
+void pack_ring_p(uint8_t bytes[SMAUGT_CTPOLY1_BYTES], const poly *data);
+void unpack_ring_p(poly *data, const uint8_t bytes[SMAUGT_CTPOLY1_BYTES]);
+
+void pack_ring_p_prime(uint8_t bytes[SMAUGT_CTPOLY2_BYTES], const poly *data);
+void unpack_ring_p_prime(poly *data, const uint8_t bytes[SMAUGT_CTPOLY2_BYTES]);
+
+void pack_ring_vec(uint8_t bytes[SMAUGT_PKPOLYVEC_BYTES], const polyvec *data);
+void unpack_ring_vec(polyvec *data,
+                     const uint8_t bytes[SMAUGT_PKPOLYVEC_BYTES]);
+
+void pack_ring_p_vec(uint8_t bytes[SMAUGT_CTPOLYVEC_BYTES],
+                     const polyvec *data);
+void unpack_ring_p_vec(polyvec *data,
+                       const uint8_t bytes[SMAUGT_CTPOLYVEC_BYTES]);
+
+void pack_ring_mat(uint8_t bytes[SMAUGT_PKPOLYMAT_BYTES],
+                   const polyvec data[SMAUGT_K]);
+void unpack_ring_mat(polyvec data[SMAUGT_K],
+                     const uint8_t bytes[SMAUGT_PKPOLYMAT_BYTES]);
+
+#endif /* !SMAUGT_PACK_H */

data/vendor/SMAUG-T/include/packring.h

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_PACK_RING_H
+#define SMAUGT_PACK_RING_H
+
+#include "params.h"
+#include "poly.h"
+
+#include <stdint.h>
+
+#define _CONCAT(a, b) a##b
+#define CONCAT(a, b) _CONCAT(a, b)
+
+#define PACK_RING(q) CONCAT(pack_R2_, q)
+#define UNPACK_RING(q) CONCAT(unpack_R2_, q)
+
+#define pack_R2_3 SMAUGT_NAMESPACE(pack_R2_3)
+#define unpack_R2_3 SMAUGT_NAMESPACE(unpack_R2_3)
+
+#define pack_R2_4 SMAUGT_NAMESPACE(pack_R2_4)
+#define unpack_R2_4 SMAUGT_NAMESPACE(unpack_R2_4)
+
+#define pack_R2_5 SMAUGT_NAMESPACE(pack_R2_5)
+#define unpack_R2_5 SMAUGT_NAMESPACE(unpack_R2_5)
+
+#define pack_R2_7 SMAUGT_NAMESPACE(pack_R2_7)
+#define unpack_R2_7 SMAUGT_NAMESPACE(unpack_R2_7)
+
+#define pack_R2_8 SMAUGT_NAMESPACE(pack_R2_8)
+#define unpack_R2_8 SMAUGT_NAMESPACE(unpack_R2_8)
+
+#define pack_R2_9 SMAUGT_NAMESPACE(pack_R2_9)
+#define unpack_R2_9 SMAUGT_NAMESPACE(unpack_R2_9)
+
+#define pack_R2_10 SMAUGT_NAMESPACE(pack_R2_10)
+#define unpack_R2_10 SMAUGT_NAMESPACE(unpack_R2_10)
+
+#define pack_R2_11 SMAUGT_NAMESPACE(pack_R2_11)
+#define unpack_R2_11 SMAUGT_NAMESPACE(unpack_R2_11)
+
+void PACK_RING(SMAUGT_LOG_Q)(uint8_t *bytes, const poly *data);
+void UNPACK_RING(SMAUGT_LOG_Q)(poly *data, const uint8_t *bytes);
+
+void PACK_RING(SMAUGT_LOG_P)(uint8_t *bytes, const poly *data);
+void UNPACK_RING(SMAUGT_LOG_P)(poly *data, const uint8_t *bytes);
+
+void PACK_RING(SMAUGT_LOG_P_PRIME)(uint8_t *bytes, const poly *data);
+void UNPACK_RING(SMAUGT_LOG_P_PRIME)(poly *data, const uint8_t *bytes);
+
+#endif /* !SMAUGT_PACK_RING_H */

data/vendor/SMAUG-T/include/params.h

@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_PARAMS_H
+#define SMAUGT_PARAMS_H
+
+#include "config.h"
+
+#define SMAUGT_MODE SMAUGT_CONFIG_MODE
+#define SMAUGT_NAMESPACE(s)                                                    \
+    SMAUGT_CONCAT(SMAUGT_CONFIG_NAMESPACE_PREFIX_MODE, s)
+#define SMAUGT_CRYPTO_ALGNAME                                                  \
+    SMAUGT_STR(SMAUGT_CONCAT(smaugt_, SMAUGT_CONFIG_MODE_STRING))
+
+#define SMAUGT_N 256                      // LWE dim and LWR dim
+#define SMAUGT_DELTA_BYTES (SMAUGT_N / 8) // 32
+#define SMAUGT_T_BYTES (SMAUGT_N / 8)     // 32
+#define SMAUGT_LOG_T 1                    // plaintext modulus
+
+#if SMAUGT_MODE == SMAUGT_MODE1
+#define SMAUGT_K 2           // rank of the module, in (2, 3, 4)
+#define SMAUGT_LOG_Q 10      // public key modulus
+#define SMAUGT_LOG_P 8       // ciphertext modulus
+#define SMAUGT_LOG_P_PRIME 5 // ciphertext2 modulus
+#define SMAUGT_CBDSEED_BYTES ((3 * SMAUGT_N) / 8)
+#define SMAUGT_MSG_BYTES SMAUGT_DELTA_BYTES
+#elif SMAUGT_MODE == SMAUGT_MODE3
+#define SMAUGT_K 3           // rank of the module, in (2, 3, 4)
+#define SMAUGT_LOG_Q 11      // public key modulus
+#define SMAUGT_LOG_P 9       // ciphertext modulus
+#define SMAUGT_LOG_P_PRIME 4 // ciphertext2 modulus
+#define SMAUGT_CBDSEED_BYTES ((2 * SMAUGT_N) / 8)
+#define SMAUGT_MSG_BYTES SMAUGT_DELTA_BYTES
+#elif SMAUGT_MODE == SMAUGT_MODE5
+#define SMAUGT_K 4           // rank of the module, in (2, 3, 4)
+#define SMAUGT_LOG_Q 11      // public key modulus
+#define SMAUGT_LOG_P 9       // ciphertext modulus
+#define SMAUGT_LOG_P_PRIME 7 // ciphertext2 modulus
+#define SMAUGT_CBDSEED_BYTES ((4 * SMAUGT_N) / 8)
+#define SMAUGT_MSG_BYTES SMAUGT_DELTA_BYTES
+#elif SMAUGT_MODE == SMAUGT_MODET
+#define SMAUGT_K 2           // rank of the module, in (2, 3, 4)
+#define SMAUGT_LOG_Q 10      // public key modulus
+#define SMAUGT_LOG_P 8       // ciphertext modulus
+#define SMAUGT_LOG_P_PRIME 3 // ciphertext2 modulus
+#define SMAUGT_CBDSEED_BYTES ((3 * SMAUGT_N) / 8)
+#define SMAUGT_MSG_BYTES 16 // for D2
+#endif
+
+#define SMAUGT_MODULUS_16_LOG_Q                                                \
+    (16 - SMAUGT_LOG_Q) // modulus (16 - SMAUGT_LOG_Q)
+#define SMAUGT_MODULUS_16_LOG_P                                                \
+    (16 - SMAUGT_LOG_P) // modulus (16 - SMAUGT_LOG_P)
+#define SMAUGT_MODULUS_16_LOG_P_PRIME                                          \
+    (16 - SMAUGT_LOG_P_PRIME) // modulus (16 - SMAUGT_LOG_P_PRIME)
+#define SMAUGT_MODULUS_16_LOG_T                                                \
+    (16 - SMAUGT_LOG_T) // modulus (16 - SMAUGT_LOG_T)
+
+// Size of keys and ciphertext
+#define SMAUGT_SHARED_SECRETE_BYTES (32)                   // 32
+#define SMAUGT_CRYPTO_BYTES SMAUGT_SHARED_SECRETE_BYTES    // 32
+#define SMAUGT_CTPOLY1_BYTES (SMAUGT_LOG_P * SMAUGT_N / 8) // element in R_p
+#define SMAUGT_CTPOLY2_BYTES                                                   \
+    (SMAUGT_LOG_P_PRIME * SMAUGT_N / 8)    // element in R_p'
+#define SMAUGT_SKPOLY_BYTES (SMAUGT_N / 4) // 64
+#define SMAUGT_SKPOLYVEC_BYTES                                                 \
+    (SMAUGT_SKPOLY_BYTES * SMAUGT_K) // vector of secret polynomials
+#define SMAUGT_CTPOLYVEC_BYTES                                                 \
+    (SMAUGT_CTPOLY1_BYTES * SMAUGT_K) // vector with element in R_p
+#define SMAUGT_CIPHERTEXT_BYTES                                                \
+    (SMAUGT_CTPOLYVEC_BYTES + SMAUGT_CTPOLY2_BYTES)         // (vector c21, c22)
+#define SMAUGT_PKSEED_BYTES (32)                            // seed for a(x) 32
+#define SMAUGT_PKPOLY_BYTES ((SMAUGT_LOG_Q * SMAUGT_N) / 8) // b(x)
+#define SMAUGT_PKPOLYVEC_BYTES                                                 \
+    (SMAUGT_PKPOLY_BYTES * SMAUGT_K) // vector with element in R_q
+#define SMAUGT_PKPOLYMAT_BYTES                                                 \
+    (SMAUGT_PKPOLYVEC_BYTES * SMAUGT_K) // matrix with element in R_q
+#define SMAUGT_PUBLICKEY_BYTES                                                 \
+    (SMAUGT_PKSEED_BYTES + SMAUGT_PKPOLYVEC_BYTES) // (A seed, b(x) vector)
+#define SMAUGT_PKE_SECRETKEY_BYTES (SMAUGT_SKPOLYVEC_BYTES) // s(x) vector
+#define SMAUGT_KEM_SECRETKEY_BYTES                                             \
+    (SMAUGT_PKE_SECRETKEY_BYTES + SMAUGT_T_BYTES +                             \
+     SMAUGT_PUBLICKEY_BYTES) // s(x) vector, t, pk
+
+#endif /* !SMAUGT_PARAMS_H */

data/vendor/SMAUG-T/include/poly.h

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_POLY_H
+#define SMAUGT_POLY_H
+
+#include "params.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#if SMAUGT_MODE == SMAUGT_MODET
+#define SMAUGT_MODULUS_SCALED_Q_HALF 32767 // for D2, Q/2 = 2^15 - 1
+#endif
+
+typedef struct {
+    int16_t coeffs[SMAUGT_N];
+} poly;
+
+typedef struct {
+    poly vec[SMAUGT_K];
+} polyvec;
+
+#define vec_vec_mult_add SMAUGT_NAMESPACE(vec_vec_mult_add)
+#define matrix_vec_mult_add SMAUGT_NAMESPACE(matrix_vec_mult_add)
+#define matrix_vec_mult_sub SMAUGT_NAMESPACE(matrix_vec_mult_sub)
+
+void vec_vec_mult_add(poly *r, const polyvec *a, const polyvec *b, uint8_t mod);
+void matrix_vec_mult_add(polyvec *r, const polyvec a[SMAUGT_K],
+                         const polyvec *b);
+void matrix_vec_mult_sub(polyvec *r, const polyvec a[SMAUGT_K],
+                         const polyvec *b);
+
+#if SMAUGT_MODE == SMAUGT_MODET
+#define d2_ecd SMAUGT_NAMESPACE(d2_ecd)
+#define d2_dcd SMAUGT_NAMESPACE(d2_dcd)
+
+void d2_ecd(poly *r, const uint8_t msg[SMAUGT_MSG_BYTES]);
+void d2_dcd(uint8_t msg[SMAUGT_MSG_BYTES], const poly *x);
+#endif
+
+#endif /* !SMAUGT_POLY_H */

data/vendor/SMAUG-T/include/randombytes.h

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_RANDOMBYTES_H
+#define SMAUGT_RANDOMBYTES_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+int randombytes(uint8_t *x, size_t xlen);
+
+#endif /* !SMAUGT_RANDOMBYTES_H */

data/vendor/SMAUG-T/include/toomcook.h

@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_TOOMCOOK_H
+#define SMAUGT_TOOMCOOK_H
+
+#include "params.h"
+
+#include <stdint.h>
+
+#define poly_mul_acc SMAUGT_NAMESPACE(poly_mul_acc)
+void poly_mul_acc(const int16_t a[SMAUGT_N], const int16_t b[SMAUGT_N],
+                  int16_t res[SMAUGT_N]);
+
+#endif /* !SMAUGT_TOOMCOOK_H */

data/vendor/SMAUG-T/include/verify.h

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef SMAUGT_VERIFY_H
+#define SMAUGT_VERIFY_H
+
+#include "params.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define verify SMAUGT_NAMESPACE(verify)
+int verify(const uint8_t *a, const uint8_t *b, size_t len);
+#define cmov SMAUGT_NAMESPACE(cmov)
+void cmov(uint8_t *r, const uint8_t *x, size_t len, uint8_t b);
+
+#endif /* !SMAUGT_VERIFY_H */

data/vendor/SMAUG-T/src/cbd.c

@@ -0,0 +1,159 @@
+// SPDX-License-Identifier: MIT
+
+#include "cbd.h"
+
+#if SMAUGT_MODE == SMAUGT_MODE1 || SMAUGT_MODE == SMAUGT_MODET
+#define load24_littleendian SMAUGT_NAMESPACE(load24_littleendian)
+static uint32_t load24_littleendian(const uint8_t x[3]) {
+    uint32_t r;
+    r = (uint32_t)x[0];
+    r |= (uint32_t)x[1] << 8;
+    r |= (uint32_t)x[2] << 16;
+    return r;
+}
+
+/*************************************************
+ * Name:        sp_cbd1
+ *
+ * Description: Given an array of uniformly random bytes, compute
+ *              polynomial with coefficients distributed according to
+ *              a modified centered binomial distribution with parameter eta=2
+ *              (p(0)=3/4, p(1)=p(-1)=1/8)
+ *
+ * Arguments:   - poly *r: pointer to output polynomial
+ *              - const uint8_t buf[SMAUGT_CBDSEED_BYTES]: pointer to input byte
+ *              array
+ *
+ * Specification: Implements Algorithm 7, spCBD1.
+ **************************************************/
+#define sp_cbd1 SMAUGT_NAMESPACE(sp_cbd1)
+static void sp_cbd1(poly *r, const uint8_t buf[SMAUGT_CBDSEED_BYTES]) {
+    unsigned int i, j;
+    uint32_t t, d, s;
+    int16_t a;
+
+    for (i = 0; i < SMAUGT_N / 8; i++) {
+        t = load24_littleendian(buf + 3 * i);
+        d = t & 0x00249249;
+        d &= (t >> 1) & 0x00249249;
+        s = (t >> 2) & 0x00249249;
+
+        for (j = 0; j < 8; j++) {
+            a = (d >> (3 * j)) & 0x1;
+            r->coeffs[8 * i + j] =
+                a * (((((s >> (3 * j)) & 0x1) - 1) ^ -2) | 1);
+        }
+    }
+}
+#endif
+
+#if SMAUGT_MODE == SMAUGT_MODE3 || SMAUGT_MODE == SMAUGT_MODE5
+/*************************************************
+ * Name:        load32_littleendian
+ *
+ * Description: load 4 bytes into a 32-bit integer
+ *              in little-endian order
+ *
+ * Arguments:   - const uint8_t x[4]: pointer to input byte array
+ *
+ * Return: 32-bit unsigned integer loaded from x
+ **************************************************/
+#define load32_littleendian SMAUGT_NAMESPACE(load32_littleendian)
+static uint32_t load32_littleendian(const uint8_t x[4]) {
+    uint32_t r;
+    r = (uint32_t)x[0];
+    r |= (uint32_t)x[1] << 8;
+    r |= (uint32_t)x[2] << 16;
+    r |= (uint32_t)x[3] << 24;
+    return r;
+}
+#endif
+
+#if SMAUGT_MODE == SMAUGT_MODE3
+/*************************************************
+ * Name:        cbd
+ *
+ * Description: Given an array of uniformly random bytes, compute
+ *              polynomial with coefficients distributed according to
+ *              a centered binomial distribution with parameter eta=1
+ *
+ * Arguments:   - poly *r: pointer to output polynomial
+ *              - const uint8_t buf[SMAUGT_CBDSEED_BYTES]: pointer to input byte
+ *              array
+ *
+ * Specification: Implements Algorithm 9, CBD.
+ **************************************************/
+#define cbd SMAUGT_NAMESPACE(cbd)
+static void cbd(poly *r, const uint8_t buf[SMAUGT_CBDSEED_BYTES]) {
+    unsigned int i, j;
+    uint32_t t;
+    int16_t a, b;
+
+    for (i = 0; i < SMAUGT_N / 16; i++) {
+        t = load32_littleendian(buf + 4 * i);
+
+        for (j = 0; j < 16; j++) {
+            a = (t >> (2 * j + 0)) & 0x01;
+            b = (t >> (2 * j + 1)) & 0x01;
+            r->coeffs[16 * i + j] = a - b;
+        }
+    }
+}
+#endif
+#if SMAUGT_MODE == SMAUGT_MODE5
+/*************************************************
+ * Name:        sp_cbd2
+ *
+ * Description: Given an array of uniformly random bytes, compute
+ *              polynomial with coefficients distributed according to
+ *              a modified centered binomial distribution with parameter eta=2
+ *              (p(0)=5/8, p(1)=p(-1)=3/16)
+ *
+ * Arguments:   - poly *r: pointer to output polynomial
+ *              - const uint8_t buf[SMAUGT_CBDSEED_BYTES]: pointer to input byte
+ *              array
+ *
+ * Specification: Implements Algorithm 8, spCBD2.
+ **************************************************/
+#define sp_cbd2 SMAUGT_NAMESPACE(sp_cbd2)
+static void sp_cbd2(poly *r, const uint8_t buf[SMAUGT_CBDSEED_BYTES]) {
+    unsigned int i, j;
+    uint32_t t, s, d;
+    int16_t a;
+
+    for (i = 0; i < SMAUGT_N / 8; i++) {
+        t = load32_littleendian(buf + 4 * i);
+        d = t & 0x11111111;
+        d |= (t >> 1) & 0x11111111;
+        d &= (t >> 2) & 0x11111111;
+        s = (t >> 3) & 0x11111111;
+        for (j = 0; j < 8; j++) {
+            a = (d >> (4 * j)) & 0x1;
+            r->coeffs[8 * i + j] =
+                a * (((((s >> (4 * j)) & 0x1) - 1) ^ -2) | 1);
+        }
+    }
+}
+#endif
+
+/*************************************************
+ * Name:        sp_cbd
+ *
+ * Description: Given an array of uniformly random bytes, compute
+ *              polynomial with coefficients
+ *
+ * Arguments:   - poly *r: pointer to output polynomial
+ *              - const uint8_t buf[SMAUGT_CBDSEED_BYTES]: pointer to input byte
+ *              array
+ *
+ * Specification: Implements Algorithm 6, spCBD.
+ **************************************************/
+void sp_cbd(poly *r, const uint8_t buf[SMAUGT_CBDSEED_BYTES]) {
+#if SMAUGT_MODE == SMAUGT_MODE1 || SMAUGT_MODE == SMAUGT_MODET
+    sp_cbd1(r, buf);
+#elif SMAUGT_MODE == SMAUGT_MODE3
+    cbd(r, buf);
+#elif SMAUGT_MODE == SMAUGT_MODE5
+    sp_cbd2(r, buf);
+#endif
+}

data/vendor/SMAUG-T/src/ciphertext.c

@@ -0,0 +1,95 @@
+// SPDX-License-Identifier: MIT
+
+#include "ciphertext.h"
+
+/*************************************************
+ * Name:        round1
+ *
+ * Description: rounding q to p
+ *
+ * Arguments:   - polyvec *a: pointer to inout vector a. This should be
+ *                already initialized.
+ *
+ * Specification: Implements Algorithm 12, Round1.
+ **************************************************/
+#define round1 SMAUGT_NAMESPACE(round1)
+static inline void round1(polyvec *a) {
+    unsigned int i, j;
+    for (i = 0; i < SMAUGT_K; ++i) {
+        for (j = 0; j < SMAUGT_N; ++j) {
+            a->vec[i].coeffs[j] =
+                ((a->vec[i].coeffs[j] + SMAUGT_RD_ADD) & SMAUGT_RD_AND) >>
+                SMAUGT_MODULUS_16_LOG_P;
+        }
+    }
+}
+
+/*************************************************
+ * Name:        computeC1
+ *
+ * Description: Compute the first ciphertext c1 = round(p/q * (A * r))
+ *
+ * Arguments:   - polyvec *c1: pointer to output vector c1. The c1 should be
+ *              already initialized
+ *              - const polyvec A[SMAUGT_K]: pointer to input matrix of public A
+ *              - const polyvec *r: pointer to input vector of ephemeral key r
+ **************************************************/
+void computeC1(polyvec *c1, const polyvec A[SMAUGT_K], const polyvec *r) {
+    // c1 = A * r
+    matrix_vec_mult_add(c1, A, r);
+
+    // Rounding q to p
+    round1(c1);
+}
+
+/*************************************************
+ * Name:        round2
+ *
+ * Description: rounding q to p'
+ *
+ * Arguments:   - poly *a: pointer to an input/output vector a. This should be
+ *              already initialized.
+ *
+ * Specification: Implements Algorithm 13, Round2.
+ **************************************************/
+#define round2 SMAUGT_NAMESPACE(round2)
+static inline void round2(poly *a) {
+    unsigned int i;
+    for (i = 0; i < SMAUGT_N; ++i) {
+        a->coeffs[i] = ((a->coeffs[i] + SMAUGT_RD_ADD2) & SMAUGT_RD_AND2) >>
+                       SMAUGT_MODULUS_16_LOG_P_PRIME;
+    }
+}
+/*************************************************
+ * Name:        computeC2
+ *
+ * Description: Compute the secode ciphertext c2 = round(p/q * (b^T * r) + msg)
+ *
+ * Arguments:   - poly *c2: pointer to ouptput poly c2. The c2 should be
+ *              already initialized
+ *              - const uint8_t delta[SMAUGT_MSG_BYTES]: pointer to input
+ * message delta
+ *              - const polyvec *b: pointer to input vector of public b
+ *              - const polyvec *r: pointer to input vector of ephemeral key r
+ **************************************************/
+void computeC2(poly *c2, const uint8_t delta[SMAUGT_MSG_BYTES],
+               const polyvec *b, const polyvec *r) {
+#if SMAUGT_MODE == SMAUGT_MODET
+    // c2 = q/2 * delta
+    d2_ecd(c2, delta); // EDIT TiMER
+#else
+    unsigned int i, j;
+    // c2 = q/2 * delta
+    for (i = 0; i < SMAUGT_MSG_BYTES; ++i) {
+        for (j = 0; j < sizeof(uint8_t) * 8; ++j) {
+            c2->coeffs[8 * i + j] =
+                (uint16_t)((delta[i] >> j) << SMAUGT_MODULUS_16_LOG_T);
+        }
+    }
+#endif
+    // c2 = q/2 * delta + (b * r)
+    vec_vec_mult_add(c2, b, r, SMAUGT_MODULUS_16_LOG_Q);
+
+    // Rounding q to p'
+    round2(c2);
+}