kpqc 0.1.0

data/vendor/SMAUG-T/src/hash.c

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: MIT
+
+#include "hash.h"
+#include "fips202.h"
+
+void shake256_absorb_twice_squeeze(uint8_t *out, size_t outlen,
+                                   const uint8_t *in1, size_t inlen1,
+                                   const uint8_t *in2, size_t inlen2) {
+    keccak_state state;
+    shake256_init(&state);
+    shake256_absorb(&state, in1, inlen1);
+    shake256_absorb(&state, in2, inlen2);
+    shake256_finalize(&state);
+    shake256_squeeze(out, outlen, &state);
+}

data/vendor/SMAUG-T/src/hwt.c

@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: MIT
+
+#include "hwt.h"
+#include "fips202.h"
+
+/*************************************************
+ * Name:        load16_littleendian
+ *
+ * Description: load 2 bytes into a 16-bit integer
+ *              in little-endian order
+ *
+ * Arguments:   - uint16_t *out: pointer to output int16_t array
+ *              - size_t outlen: output length
+ *              - const uint8_t *in: pointer to input byte array
+ **************************************************/
+#define load16_littleendian SMAUGT_NAMESPACE(load16_littleendian)
+static void load16_littleendian(uint16_t *out, size_t outlen,
+                                const uint8_t *in) {
+    size_t pos = 0;
+    for (size_t i = 0; i < outlen; ++i) {
+        out[i] = ((uint16_t)(in[pos])) | ((uint16_t)(in[pos + 1]) << 8);
+        pos += 2;
+    }
+}
+
+// referenced
+// Décio Luiz Gazzoni Filho and Tomás S. R. Silva and Julio López
+// “Efficient isochronous fixed-weight sampling with applications to {NTRU},” in
+// Cryptology {ePrint} Archive, Paper 2024/548. 2024,
+// url: eprint.iacr.org/2024/548.
+/*************************************************
+ * Name:        rej_sample_mod
+ *
+ * Description: Sample array of random integers such that res[i] is in the range
+ *              [0, SMAUGT_N - i] for 0 <= i < SMAUGT_N
+ *
+ * Arguments:   - uint8_t si[SMAUGT_N]: pointer to ouptput polynomial r(x),
+ *              assumed to be already initialized
+ *              - const uint16_t *seed: pointer to input seed (of length
+ *              SMAUGT_HWTSEEDBYTES/2)
+ *
+ * Specification: Implements Algorithm 4, RejSampleMod.
+ **************************************************/
+#define rej_sample_mod SMAUGT_NAMESPACE(rej_sample_mod)
+static int rej_sample_mod(int16_t si[SMAUGT_N], const uint16_t *rand) {
+    unsigned int i, j = SMAUGT_N;
+    uint32_t m;
+    uint16_t s, t, l;
+
+    for (i = 0; i < SMAUGT_N; i++) {
+        s = SMAUGT_N - i;
+        t = 65536 % s;
+
+        m = (uint32_t)rand[i] * s;
+        l = m;
+
+        while (l < t) {
+            if (j >= (SMAUGT_HWTSEEDBYTES / 2))
+                return -1; // all randomness used
+            m = (uint32_t)rand[j++] * s;
+            l = m;
+        }
+
+        si[i] = m >> 16;
+    }
+
+    return 0;
+}
+
+/*************************************************
+ * Name:        hwt
+ *
+ * Description: Hamming weight sampling deterministically to generate sparse
+ *              polynomial r(x) from a seed. shake256 is the Extendable-Output
+ *              Function from the SHA-3 family.
+ *
+ * Arguments:   - int16_t *res: pointer to ouptput polynomial r(x)
+ *              (of length SMAUGT_N), assumed to be already initialized
+ *              - const uint8_t *seed: pointer to input seed (of length
+ *              SMAUGT_CRYPTO_BYTES + 2)
+ *
+ * Specification: Implements Algorithm 3, HWT.
+ **************************************************/
+int hwt(int16_t *res, const uint8_t *seed) {
+    unsigned int i;
+    int16_t si[SMAUGT_N] = {0};
+    uint16_t rand[SMAUGT_HWTSEEDBYTES / 2] = {0};
+    uint8_t sign[SMAUGT_N / 4] = {0};
+    uint8_t buf[SMAUGT_HWTSEEDBYTES] = {0};
+
+    keccak_state state;
+    shake256_init(&state);
+    shake256_absorb_once(&state, seed, SMAUGT_CRYPTO_BYTES + 2);
+
+    // only executed once with overwhelming probability:
+    shake256_squeeze(buf, SMAUGT_HWTSEEDBYTES, &state);
+    load16_littleendian(rand, SMAUGT_HWTSEEDBYTES / 2, buf);
+    if (rej_sample_mod(si, rand)) {
+        return -1;
+    }
+
+    shake256_squeeze(sign, SMAUGT_N / 4, &state);
+
+    int16_t t0;
+    int16_t c0 = SMAUGT_N - SMAUGT_HS;
+    for (i = 0; i < SMAUGT_N; i++) {
+        t0 = (si[i] - c0) >> 15;
+        c0 += t0;
+        res[i] = 1 + t0;
+        // Convert to ternary
+        // index of sign: (i / 16 / 8) * 16 + (i % 16)
+        // shift size   : (i / 16) % 8
+        res[i] =
+            (-res[i]) &
+            ((((sign[(((i >> 4) >> 3) << 4) + (i & 0x0F)] >> ((i >> 4) & 0x07))
+               << 1) &
+              0x02) -
+             1);
+    }
+    return 0;
+}

data/vendor/SMAUG-T/src/indcpa.c

@@ -0,0 +1,187 @@
+// SPDX-License-Identifier: MIT
+
+#include "indcpa.h"
+#include "cbd.h"
+#include "fips202.h"
+#include "pack.h"
+#include "randombytes.h"
+#include "verify.h"
+
+#include <string.h>
+
+/*************************************************
+ * Name:        expand_r
+ *
+ * Description: Deterministically generate a vector of sparse polynomial r(x)
+ *              from a seed.
+ *
+ * Arguments:   - polyvec *r: pointer to ouptput vector r
+ *              - uint8_t *seed: pointer to input seed (of length
+ * SMAUGT_DELTA_BYTES)
+ *
+ * Specification: Implements Algorithm 5, ExpandR.
+ **************************************************/
+void expand_r(polyvec *r, const uint8_t *seed) {
+    unsigned int i;
+    uint8_t buf[SMAUGT_CBDSEED_BYTES] = {0};
+
+    for (i = 0; i < SMAUGT_K; ++i) {
+        uint8_t extseed[SMAUGT_DELTA_BYTES + 1];
+        memcpy(extseed, seed, SMAUGT_DELTA_BYTES);
+        extseed[SMAUGT_DELTA_BYTES] = i;
+
+        shake256(buf, SMAUGT_CBDSEED_BYTES, extseed, SMAUGT_DELTA_BYTES + 1);
+        sp_cbd(&r->vec[i], buf);
+    }
+}
+
+/*************************************************
+ * Name:        indcpa_keypair
+ *
+ * Description: Generates a public key and a private key deterministically
+ *              from the given randomness seed.
+ *              Key generation function of the CPA-secure Module-Lizard
+ *              public-key encryption scheme.
+ *
+ * Arguments:   - uint8_t pk[SMAUGT_PUBLICKEY_BYTES]: pointer to output public
+ *              key
+ *              - uint8_t sk[SMAUGT_PKE_SECRETKEY_BYTES]: pointer to output
+ *              private key
+ *              - uint8_t seed[SMAUGT_CRYPTO_BYTES]: pointer to input seed
+ *
+ * Specification: Implements Algorithm 25, SMAUGT-T.PKE.KeyGen.
+ **************************************************/
+void indcpa_keypair(uint8_t pk[SMAUGT_PUBLICKEY_BYTES],
+                    uint8_t sk[SMAUGT_PKE_SECRETKEY_BYTES],
+                    const uint8_t seed[SMAUGT_CRYPTO_BYTES]) {
+    public_key pk_tmp;
+    secret_key sk_tmp;
+    memset(&pk_tmp, 0, sizeof(public_key));
+    memset(&sk_tmp, 0, sizeof(secret_key));
+
+    uint8_t extseed[SMAUGT_CRYPTO_BYTES + SMAUGT_PKSEED_BYTES] = {0};
+#if SMAUGT_CRYPTO_BYTES + SMAUGT_PKSEED_BYTES != 64
+#error                                                                         \
+    "This implementation assumes SMAUGT_CRYPTO_BYTES + SMAUGT_PKSEED_BYTES to be 64"
+#endif
+    sha3_512(extseed, seed, SMAUGT_CRYPTO_BYTES);
+
+    expand_s(&sk_tmp, extseed);
+
+    memcpy(&pk_tmp.seed, extseed + SMAUGT_CRYPTO_BYTES, SMAUGT_PKSEED_BYTES);
+    gen_pub_key(&pk_tmp, &sk_tmp, extseed);
+
+    memset(pk, 0, SMAUGT_PUBLICKEY_BYTES);
+    memset(sk, 0, SMAUGT_PKE_SECRETKEY_BYTES);
+    pack_enck(pk, &pk_tmp);
+    pack_deck(sk, &sk_tmp);
+}
+
+/*************************************************
+ * Name:        indcpa_enc
+ *
+ * Description: Generates the ciphertext ctxt deterministically
+ *              by encrypting the given message mu
+ *              with the provided public key pk and the given randomness seed.
+ *              Encryption function of the CPA-secure Module-Lizard public-key
+ *              encryption scheme.
+ *
+ * Arguments:   - uint8_t ctxt[SMAUGT_CIPHERTEXT_BYTES]: pointer to output
+ *              ciphertext
+ *              - const uint8_t pk[SMAUGT_PUBLICKEY_BYTES]: pointer to input
+ *              public key
+ *              - const uint8_t mu[SMAUGT_MSG_BYTES]: pointer to input plaintext
+ *              message
+ *              - const uint8_t seed[SMAUGT_DELTA_BYTES]: pointer to input seed
+ *
+ * Specification: Implements Algorithm 26, SMAUGT-T.PKE.Enc.
+ **************************************************/
+void indcpa_enc(uint8_t ctxt[SMAUGT_CIPHERTEXT_BYTES],
+                const uint8_t pk[SMAUGT_PUBLICKEY_BYTES],
+                const uint8_t mu[SMAUGT_MSG_BYTES],
+                const uint8_t seed[SMAUGT_DELTA_BYTES]) {
+
+    uint8_t seed_r[SMAUGT_DELTA_BYTES] = {0};
+    public_key pk_tmp;
+    unpack_enck(&pk_tmp, pk);
+
+    // Compute a vector r = hwt(delta, H'(pk))
+    polyvec r;
+    memset(&r, 0, sizeof(polyvec));
+
+    if (seed == NULL)
+        { if (randombytes(seed_r, SMAUGT_DELTA_BYTES) != 0) return; }
+    else
+        cmov(seed_r, seed, SMAUGT_DELTA_BYTES, 1);
+    expand_r(&r, seed_r);
+
+    // Compute c1(x), c2(x)
+    ciphertext ctxt_tmp;
+    memset(&ctxt_tmp, 0, sizeof(ciphertext));
+    computeC1(&(ctxt_tmp.c1), pk_tmp.A, &r);
+    computeC2(&(ctxt_tmp.c2), mu, &pk_tmp.b, &r);
+
+    pack_ct(ctxt, &ctxt_tmp);
+}
+
+/*************************************************
+ * Name:        indcpa_dec
+ *
+ * Description: Generates the plaintext message mu deterministically
+ *              by decrypting the given ciphertext ctxt with the provided
+ *              private key sk. Decryption function of the CPA-secure
+ * Module-Lizard public-key encryption scheme.
+ *
+ * Arguments:   - uint8_t mu[SMAUGT_MSG_BYTES]: pointer to output plaintext
+ *              message
+ *              - const uint8_t sk[SMAUGT_PKE_SECRETKEY_BYTES]: pointer to input
+ *              private key
+ *              - const uint8_t ctxt[SMAUGT_CIPHERTEXT_BYTES]: pointer to input
+ *              ciphertext
+ *
+ * Specification: Implements Algorithm 28, SMAUGT-T.PKE.Dec.
+ **************************************************/
+void indcpa_dec(uint8_t mu[SMAUGT_MSG_BYTES],
+                const uint8_t sk[SMAUGT_PKE_SECRETKEY_BYTES],
+                const uint8_t ctxt[SMAUGT_CIPHERTEXT_BYTES]) {
+    poly delta;
+    polyvec c1;
+
+    secret_key sk_tmp;
+    memset(&sk_tmp, 0, sizeof(secret_key));
+    unpack_deck(&sk_tmp, sk);
+
+    ciphertext ctxt_tmp;
+    unpack_ct(&ctxt_tmp, ctxt);
+
+    unsigned int i, j;
+    c1 = ctxt_tmp.c1;
+    delta = ctxt_tmp.c2;
+    for (i = 0; i < SMAUGT_N; ++i)
+        delta.coeffs[i] <<= SMAUGT_MODULUS_16_LOG_P_PRIME;
+    for (i = 0; i < SMAUGT_K; ++i)
+        for (j = 0; j < SMAUGT_N; ++j)
+            c1.vec[i].coeffs[j] <<= SMAUGT_MODULUS_16_LOG_P;
+
+    // Compute delta = (delta + c1^T * s)
+    vec_vec_mult_add(&delta, &c1, &sk_tmp, SMAUGT_MODULUS_16_LOG_P);
+
+#if SMAUGT_MODE == SMAUGT_MODET
+    d2_dcd(mu, &delta); // EDIT TiMER
+#else
+    // Compute delta = 2/p * delta
+    for (i = 0; i < SMAUGT_N; ++i) {
+        delta.coeffs[i] += SMAUGT_DEC_ADD;
+        delta.coeffs[i] >>= SMAUGT_MODULUS_16_LOG_T;
+        delta.coeffs[i] &= 0x01;
+    }
+
+    // Set delta
+    memset(mu, 0, SMAUGT_MSG_BYTES);
+    for (i = 0; i < SMAUGT_MSG_BYTES; ++i) {
+        for (j = 0; j < 8; ++j) {
+            mu[i] ^= ((uint8_t)(delta.coeffs[8 * i + j]) << j);
+        }
+    }
+#endif
+}

data/vendor/SMAUG-T/src/kem.c

@@ -0,0 +1,194 @@
+/* kpqc-py: propagate OS entropy failures (2026-09-06). */
+// SPDX-License-Identifier: MIT
+
+#include "api.h"
+#include "fips202.h"
+#include "hash.h"
+#include "indcpa.h"
+#include "randombytes.h"
+#include "verify.h"
+#include <string.h>
+
+/*************************************************
+ * Name:        crypto_kem_keypair_internal
+ *
+ * Description: Generates a public key pk and a private key sk deterministically
+ *              from the given randomness (i.e., d and seed)
+ *              for the CCA-secure Module-Lizard key encapsulation mechanism.
+ *
+ * Arguments:   - uint8_t *pk: pointer to output public key
+ *              - uint8_t *sk: pointer to output private key
+ *              - uint8_t *d: pointer to input d (of length
+ *              SMAUGT_T_BYTES)
+ *              - uint8_t *seed: pointer to input seed (of length
+ *              SMAUGT_CRYPTO_BYTES)
+ *
+ * Return: 0 on success, 1 on failure
+ *
+ * Specification: Implements Algorithm 33, SMAUG-T.KEM.EncapInternal.
+ **************************************************/
+int crypto_kem_keypair_internal(uint8_t *pk, uint8_t *sk,
+                                uint8_t d[SMAUGT_T_BYTES],
+                                uint8_t seed[SMAUGT_CRYPTO_BYTES]) {
+    int ret = 0;
+    indcpa_keypair(pk, sk, seed);
+    memcpy(sk + SMAUGT_PKE_SECRETKEY_BYTES, d, SMAUGT_T_BYTES);
+    memcpy(sk + SMAUGT_PKE_SECRETKEY_BYTES + SMAUGT_T_BYTES, pk,
+           SMAUGT_PUBLICKEY_BYTES);
+
+    return ret;
+}
+
+/*************************************************
+ * Name:        crypto_kem_keypair
+ *
+ * Description: Generates a public key pk and a private key sk probabilistically
+ *              by internally sampling the required randomness (i.e., d and
+ * seed) for the CCA-secure Module-Lizard key encapsulation mechanism.
+ *
+ * Arguments:   - uint8_t *pk: pointer to output public key
+ *              - uint8_t *sk: pointer to output private key
+ *
+ * Return: 0 on success, 1 on failure
+ *
+ * Specification: Implements Algorithm 30, SMAUG-T.KEM.KeyGen.
+ **************************************************/
+int crypto_kem_keypair(uint8_t *pk, uint8_t *sk) {
+    int ret = 0;
+    uint8_t d[SMAUGT_T_BYTES] = {0};
+    uint8_t seed[SMAUGT_CRYPTO_BYTES] = {0};
+
+    if (randombytes(d, SMAUGT_T_BYTES) != 0) return -1;
+    if (randombytes(seed, SMAUGT_CRYPTO_BYTES) != 0) return -1;
+
+    ret = crypto_kem_keypair_internal(pk, sk, d, seed);
+
+    return ret;
+}
+
+/*************************************************
+ * Name:        crypto_kem_enc_internal
+ *
+ * Description: Generates a shared secret ss and an associated ciphertext ctxt
+ * deterministically for the given message mu using the provided public key pk.
+ *
+ * Arguments:   - uint8_t *ctxt: pointer to output ciphertext
+ *              - uint8_t *ss: pointer to output shared secret
+ *              (of length SMAUGT_CRYPTO_BYTES)
+ *              - uint8_t *pk: pointer to input public key
+ *              - uint8_t *mu: pointer to input message (of length
+ *              SMAUGT_DELTA_BYTES)
+ *
+ * Return: 0 on success, 1 on failure
+ *
+ * Specification: Implements Algorithm 34, SMAUG-T.KEM.EncapInternal.
+ **************************************************/
+int crypto_kem_enc_internal(uint8_t *ctxt, uint8_t *ss, const uint8_t *pk,
+                            const uint8_t *mu) {
+    int ret = 0;
+    uint8_t seed_r[SMAUGT_DELTA_BYTES + SMAUGT_CRYPTO_BYTES] = {0};
+    hash_h(seed_r, pk, SMAUGT_PUBLICKEY_BYTES);
+    hash_g(seed_r, SMAUGT_DELTA_BYTES + SMAUGT_CRYPTO_BYTES, mu,
+           SMAUGT_MSG_BYTES, seed_r, SHA3_256_HashSize);
+
+    memset(ss, 0, SMAUGT_CRYPTO_BYTES);
+    indcpa_enc(ctxt, pk, mu, seed_r);
+    cmov(ss, seed_r + SMAUGT_DELTA_BYTES, SMAUGT_CRYPTO_BYTES, 1);
+    return ret;
+}
+
+/*************************************************
+ * Name:        crypto_kem_enc
+ *
+ * Description: Generates a shared secret ss and an associated ciphertext ctxt
+ * probabilistically by internally sampling the required randomness (i.e., mu)
+ *              for the given public key.
+ *
+ * Arguments:   - uint8_t *ctxt: pointer to output ciphertext
+ *              - uint8_t *ss: pointer to output  shared secret
+ *              (of length SMAUGT_CRYPTO_BYTES)
+ *              - uint8_t *pk: pointer to input public key
+ *
+ * Return: 0 on success, 1 on failure
+ *
+ * Specification: Implements Algorithm 31, SMAUG-T.KEM.Encap.
+ **************************************************/
+int crypto_kem_enc(uint8_t *ctxt, uint8_t *ss, const uint8_t *pk) {
+    int ret = 0;
+    uint8_t mu[SMAUGT_MSG_BYTES] = {0}; // shared secret and seed
+    if (randombytes(mu, SMAUGT_MSG_BYTES) != 0) return -1;
+
+    ret = crypto_kem_enc_internal(ctxt, ss, pk, mu);
+
+    return ret;
+}
+
+/*************************************************
+ * Name:        crypto_kem_dec_internal
+ *
+ * Description: Produces a shared secret ss deterministically
+ *              for the given ciphertext ctxt using the provided private key sk.
+ *
+ * Arguments:   - uint8_t *ss: pointer to output shared secret
+ *              (of length SMAUGT_CRYPTO_BYTES)
+ *              - uint8_t *sk: pointer to input private key
+ *              - uint8_t *ctxt: pointer to input ciphertext
+ *
+ * Return: 0 on success, 1 on failure
+ *
+ * Specification: Implements Algorithm 35, SMAUG-T.KEM.DecapInternal.
+ **************************************************/
+int crypto_kem_dec_internal(uint8_t *ss, const uint8_t *ctxt,
+                            const uint8_t *sk) {
+    int ret = 0;
+    uint8_t mu[SMAUGT_MSG_BYTES] = {0};
+    uint8_t buf[SMAUGT_DELTA_BYTES + SMAUGT_CRYPTO_BYTES] = {
+        0}; // shared secret and seed
+    uint8_t buf_tmp[SMAUGT_DELTA_BYTES + SMAUGT_CRYPTO_BYTES] = {0};
+    uint8_t hash_res[SHA3_256_HashSize] = {0};
+    const uint8_t *pk = sk + SMAUGT_PKE_SECRETKEY_BYTES + SMAUGT_T_BYTES;
+
+    indcpa_dec(mu, sk, ctxt);
+    hash_h(hash_res, pk, SMAUGT_PUBLICKEY_BYTES);
+    hash_g(buf, SMAUGT_DELTA_BYTES + SMAUGT_CRYPTO_BYTES, mu, SMAUGT_MSG_BYTES,
+           hash_res, SHA3_256_HashSize);
+
+    uint8_t ctxt_temp[SMAUGT_CIPHERTEXT_BYTES] = {0};
+    indcpa_enc(ctxt_temp, pk, mu, buf);
+
+    int fail = verify(ctxt, ctxt_temp, SMAUGT_CIPHERTEXT_BYTES);
+
+    hash_h(hash_res, ctxt, SMAUGT_CIPHERTEXT_BYTES);
+    hash_g(buf_tmp, SMAUGT_DELTA_BYTES + SMAUGT_CRYPTO_BYTES,
+           sk + SMAUGT_PKE_SECRETKEY_BYTES, SMAUGT_T_BYTES, hash_res,
+           SHA3_256_HashSize);
+
+    memset(ss, 0, SMAUGT_CRYPTO_BYTES);
+    cmov(buf + SMAUGT_DELTA_BYTES, buf_tmp + SMAUGT_DELTA_BYTES,
+         SMAUGT_CRYPTO_BYTES, fail);
+    cmov(ss, buf + SMAUGT_DELTA_BYTES, SMAUGT_CRYPTO_BYTES, 1);
+
+    return ret;
+}
+
+/*************************************************
+ * Name:        crypto_kem_dec
+ *
+ * Description: Produces a shared secret ss deterministically
+ *              for the given ciphertext ctxt using the provided private key sk.
+ *
+ * Arguments:   - uint8_t *ss: pointer to output shared secret (of length
+ *              SMAUGT_CRYPTO_BYTES). On failure, ss will contain a
+ * pseudo-random value.
+ *              - uint8_t *sk: pointer to input private key
+ *              - uint8_t *ctxt: pointer to input ciphertext
+ *
+ * Return: 0 on success, 1 on failure
+ *
+ * Specification: Implements Algorithm 32, SMAUG-T.KEM.Decap.
+ **************************************************/
+int crypto_kem_dec(uint8_t *ss, const uint8_t *ctxt, const uint8_t *sk) {
+    int ret = 0;
+    ret = crypto_kem_dec_internal(ss, ctxt, sk);
+    return ret;
+}

data/vendor/SMAUG-T/src/key.c

@@ -0,0 +1,102 @@
+// SPDX-License-Identifier: MIT
+
+#include "key.h"
+#include "dg.h"
+#include "fips202.h"
+#include "hwt.h"
+#include "pack.h"
+#include "poly.h"
+
+#include <string.h>
+
+/*************************************************
+ * Name:        expand_A
+ *
+ * Description: Deterministically generate public matrix A from a seed.
+ *              Entries of the A are polynomials that look uniformly random.
+ *
+ * Arguments:   - polyvec A[SMAUGT_K]: pointer to output matrix A
+ *              - const uint8_t seed[SMAUGT_PKSEED_BYTES]: pointer to input seed
+ *
+ * Specification: Implements Algorithm 1, ExpandA.
+ **************************************************/
+void expand_A(polyvec A[SMAUGT_K], const uint8_t seed[SMAUGT_PKSEED_BYTES]) {
+    unsigned int i, j;
+    uint8_t buf[SMAUGT_PKPOLY_BYTES] = {0}, extseed[SMAUGT_PKSEED_BYTES + 2];
+    memcpy(extseed, seed, SMAUGT_PKSEED_BYTES);
+    for (i = 0; i < SMAUGT_K; i++) {
+        for (j = 0; j < SMAUGT_K; j++) {
+            extseed[32] = i;
+            extseed[33] = j;
+            shake128(buf, SMAUGT_PKPOLY_BYTES, extseed,
+                     SMAUGT_PKSEED_BYTES + 2);
+            unpack_ring(&A[i].vec[j], buf);
+        }
+    }
+}
+
+/*************************************************
+ * Name:        expand_b
+ *
+ * Description: Generate public vector b from a matrix A, vector s and noise e.
+ *              Random noise e is generated by Gaussian sampling.
+ *
+ * Arguments:   - polyvec *b: pointer to output vector b
+ *              - const polyvec A[SMAUGT_K]: pointer to input matrix A
+ *              - const polyvec *s: pointer to input vector s
+ *              - const uint8_t e_seed[SMAUGT_CRYPTO_BYTES]: pointer to input
+ *              seed of error
+ **************************************************/
+void expand_b(polyvec *b, const polyvec A[SMAUGT_K], const polyvec *s,
+              const uint8_t e_seed[SMAUGT_CRYPTO_BYTES]) {
+    // b = e
+    d_gaussian(b, e_seed);
+
+    // b = -a * s + e
+    matrix_vec_mult_sub(b, A, s);
+}
+
+/*************************************************
+ * Name:        expand_s
+ *
+ * Description: Generate a vector of secret sparse polynomial s(x) from a seed.
+ *
+ * Arguments:   - secret_key *sk: pointer to output private key
+ *              - const uint8_t seed[SMAUGT_CRYPTO_BYTES]: pointer to input seed
+ *              of s(x)
+ *
+ * Specification: Implements Algorithm 2, ExpandS.
+ **************************************************/
+void expand_s(secret_key *sk, const uint8_t seed[SMAUGT_CRYPTO_BYTES]) {
+    unsigned int i, j;
+    uint8_t extseed[SMAUGT_CRYPTO_BYTES + 2] = {0};
+    memcpy(extseed, seed, SMAUGT_CRYPTO_BYTES);
+
+    for (i = 0; i < SMAUGT_K; ++i) {
+        extseed[SMAUGT_CRYPTO_BYTES] = i * SMAUGT_K;
+        j = 0;
+        do {
+            extseed[SMAUGT_CRYPTO_BYTES + 1] = j;
+            j += 1;
+        } while (hwt(sk->vec[i].coeffs, extseed));
+    }
+}
+
+/*************************************************
+ * Name:        genPubkey
+ *
+ * Description: Generate public key correspending to private key.
+ *
+ * Arguments:   - public_key *pk: pointer to output public key
+ *              - const secret_key *sk: pointer to input private key
+ *              - const uint8_t err_seed[SMAUGT_CRYPTO_BYTES]: pointer to input
+ *              seed of error
+ **************************************************/
+void gen_pub_key(public_key *pk, const secret_key *sk,
+                 const uint8_t err_seed[SMAUGT_CRYPTO_BYTES]) {
+    expand_A(pk->A, pk->seed);
+
+    memset(&(pk->b), 0, sizeof(uint16_t) * SMAUGT_N * SMAUGT_K);
+    // Initialized at addGaussian, Unnecessary
+    expand_b(&(pk->b), pk->A, sk, err_seed);
+}