kpqc 0.1.0

data/vendor/AIMer/aim2.c

@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: MIT
+
+#include "aim2.h"
+#include "field.h"
+#include "hash.h"
+#include "params.h"
+#include <stddef.h>
+#include <stdint.h>
+
+static void generate_matrices_L_and_U(
+  gf matrix_L[AIM2_NUM_INPUT_SBOX][AIM2_NUM_BITS_FIELD],
+  gf matrix_U[AIM2_NUM_INPUT_SBOX][AIM2_NUM_BITS_FIELD],
+  gf vector_b,
+  const uint8_t iv[AIM2_IV_SIZE])
+{
+  uint8_t buf[AIM2_NUM_BYTES_FIELD];
+  uint64_t ormask, lmask, umask;
+  hash_instance ctx;
+  gf temp = {0,};
+
+  // initialize hash
+  hash_init(&ctx);
+  hash_update(&ctx, iv, AIM2_IV_SIZE);
+  hash_final(&ctx);
+
+  for (size_t ell = 0; ell < AIM2_NUM_INPUT_SBOX; ell++)
+  {
+    for (size_t row = 0; row < AIM2_NUM_BITS_FIELD; row++)
+    {
+      hash_squeeze(&ctx, buf, AIM2_NUM_BYTES_FIELD);
+      gf_from_bytes(temp, buf);
+
+      ormask = ((uint64_t)1) << (row % 64);
+      lmask = ((uint64_t)-1) << (row % 64);
+      umask = ~lmask;
+
+      size_t inter = row / 64;
+      size_t col_word;
+      for (col_word = 0; col_word < inter; col_word++)
+      {
+        // L is zero, U is full
+        matrix_L[ell][row][col_word] = 0;
+        matrix_U[ell][row][col_word] = temp[col_word];
+      }
+      matrix_L[ell][row][inter] = (temp[inter] & lmask) | ormask;
+      matrix_U[ell][row][inter] = (temp[inter] & umask) | ormask;
+      for (col_word = inter + 1; col_word < AIM2_NUM_WORDS_FIELD; col_word++)
+      {
+        // L is full, U is zero
+        matrix_L[ell][row][col_word] = temp[col_word];
+        matrix_U[ell][row][col_word] = 0;
+      }
+    }
+  }
+
+  hash_squeeze(&ctx, (uint8_t *)vector_b, AIM2_NUM_BYTES_FIELD);
+  hash_ctx_release(&ctx);
+}
+
+void aim2_generate_linear(gf matrix_A[AIM2_NUM_INPUT_SBOX][AIM2_NUM_BITS_FIELD],
+                          gf vector_b,
+                          const uint8_t iv[AIM2_IV_SIZE])
+{
+  gf matrix_L[AIM2_NUM_INPUT_SBOX][AIM2_NUM_BITS_FIELD];
+  gf matrix_U[AIM2_NUM_INPUT_SBOX][AIM2_NUM_BITS_FIELD];
+
+  generate_matrices_L_and_U(matrix_L, matrix_U, vector_b, iv);
+
+  for (size_t ell = 0; ell < AIM2_NUM_INPUT_SBOX; ell++)
+  {
+    for (size_t i = 0; i < AIM2_NUM_BITS_FIELD; i++)
+    {
+      gf_mat_vec_mul(matrix_A[ell][i], matrix_U[ell][i],
+                     (const gf *)matrix_L[ell]);
+    }
+  }
+}
+
+void aim2(uint8_t ct[AIM2_NUM_BYTES_FIELD],
+          const uint8_t pt[AIM2_NUM_BYTES_FIELD],
+          const uint8_t iv[AIM2_IV_SIZE])
+{
+  gf matrix_L[AIM2_NUM_INPUT_SBOX][AIM2_NUM_BITS_FIELD];
+  gf matrix_U[AIM2_NUM_INPUT_SBOX][AIM2_NUM_BITS_FIELD];
+  gf vector_b = {0,};
+
+  gf state[AIM2_NUM_INPUT_SBOX];
+  gf pt_gf = {0,}, ct_gf = {0,};
+  gf_from_bytes(pt_gf, pt);
+
+  // generate random matrix
+  generate_matrices_L_and_U(matrix_L, matrix_U, vector_b, iv);
+
+  for (size_t i = 0; i < AIMER_L; i++)
+  {
+    // linear component: constant addition
+    gf_add(state[i], pt_gf, aim2_constants[i]);
+
+    // non-linear component: inverse Mersenne S-box
+    gf_exp(state[i], state[i], aim2_sbox_exponents[i]);
+
+    // linear component: affine layer
+    gf_mat_vec_mul(state[i], state[i], (const gf *)matrix_U[i]);
+    gf_mat_vec_mul(state[i], state[i], (const gf *)matrix_L[i]);
+  }
+
+  for (size_t i = 1; i < AIMER_L; i++)
+  {
+    gf_add(state[0], state[0], state[i]);
+  }
+  gf_add(state[0], state[0], vector_b);
+
+  // non-linear component: Mersenne S-box
+  gf_exp(state[0], state[0], aim2_sbox_exponents[AIMER_L]);
+
+  // linear component: feed-forward
+  gf_add(ct_gf, state[0], pt_gf);
+
+  gf_to_bytes(ct, ct_gf);
+}
+
+void aim2_sbox_outputs(gf sbox_outputs[AIM2_NUM_INPUT_SBOX], const gf pt)
+{
+  for (size_t i = 0; i < AIMER_L; i ++)
+  {
+    // linear component: constant addition
+    gf_add(sbox_outputs[i], pt, aim2_constants[i]);
+
+    // non-linear component: inverse Mersenne S-box
+    gf_exp(sbox_outputs[i], sbox_outputs[i], aim2_sbox_exponents[i]);
+  }
+}
+
+void aim2_mpc(mult_chk_t *mult_chk,
+              const gf matrix_A[AIMER_L][AIM2_NUM_BITS_FIELD],
+              const gf ct_gf)
+{
+  // pt + c = t ^ {2 ^ e - 1}
+  // --> t ^ {2 ^ e} + t * c = t * pt
+  // --> z = x * pt
+  for (size_t ell = 0; ell < AIMER_L; ell++)
+  {
+    gf_sqr(mult_chk->z_shares[ell], mult_chk->x_shares[ell]);
+    for (size_t i = 1; i < aim2_exponents[ell]; i++)
+    {
+      gf_sqr(mult_chk->z_shares[ell], mult_chk->z_shares[ell]);
+    }
+    gf_mul_add(mult_chk->z_shares[ell], mult_chk->x_shares[ell],
+               aim2_constants[ell]);
+    gf_mat_vec_mul_add(mult_chk->x_shares[AIMER_L],
+                       mult_chk->x_shares[ell], matrix_A[ell]);
+  }
+
+  // x ^ {2 ^ e - 1} = pt + ct
+  // --> x ^ {2 ^ e} + x * ct = x * pt
+  // --> z = x * pt
+  gf_sqr(mult_chk->z_shares[AIMER_L], mult_chk->x_shares[AIMER_L]);
+  for (size_t i = 1; i < aim2_exponents[AIMER_L]; i++)
+  {
+    gf_sqr(mult_chk->z_shares[AIMER_L], mult_chk->z_shares[AIMER_L]);
+  }
+  gf_mul_add(mult_chk->z_shares[AIMER_L], mult_chk->x_shares[AIMER_L], ct_gf);
+}

data/vendor/AIMer/aim2.h

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef AIM2_H
+#define AIM2_H
+
+#include "aim2_constant.h"
+#include "field.h"
+#include "params.h"
+#include <stdint.h>
+
+typedef struct mult_chk_t
+{
+  gf pt_share;
+  gf x_shares[AIMER_L + 1];
+  gf z_shares[AIMER_L + 1];
+} mult_chk_t;
+
+#define aim2_generate_linear AIMER_NAMESPACE(aim2_generate_linear)
+void aim2_generate_linear(gf matrix_A[AIM2_NUM_INPUT_SBOX][AIM2_NUM_BITS_FIELD],
+                          gf vector_b,
+                          const uint8_t iv[AIM2_IV_SIZE]);
+
+#define aim2_sbox_outputs AIMER_NAMESPACE(aim2_sbox_outputs)
+void aim2_sbox_outputs(gf sbox_outputs[AIM2_NUM_INPUT_SBOX], const gf pt);
+
+#define aim2 AIMER_NAMESPACE(aim2)
+void aim2(uint8_t ct[AIM2_NUM_BYTES_FIELD],
+          const uint8_t pt[AIM2_NUM_BYTES_FIELD],
+          const uint8_t iv[AIM2_IV_SIZE]);
+
+#define aim2_mpc AIMER_NAMESPACE(aim2_mpc)
+void aim2_mpc(mult_chk_t *mult_chk,
+              const gf matrix_A[AIMER_L][AIM2_NUM_BITS_FIELD],
+              const gf ct_gf);
+
+#endif // AIM2_H

data/vendor/AIMer/aim2_constant.h

@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef AIM2_CONSTANT_H
+#define AIM2_CONSTANT_H
+
+#include "field.h"
+#include "params.h"
+#include <stdint.h>
+
+#if SECURITY_BITS == 128
+static const gf aim2_constants[AIM2_NUM_INPUT_SBOX] =
+{
+  {0x13198a2e03707344, 0x243f6a8885a308d3},
+  {0x082efa98ec4e6c89, 0xa4093822299f31d0},
+};
+
+static const uint64_t
+aim2_sbox_exponents[AIM2_NUM_INPUT_SBOX + 1][AIM2_NUM_WORDS_FIELD] =
+{
+  {0x6b6b6d6dadadb5b5, 0xb6b6d6d6dadb5b5b},
+  {0x6d6db6d6db6b6db5, 0xb6db5b6dadb6dadb},
+  {7, 0}
+};
+
+static const size_t aim2_exponents[AIM2_NUM_INPUT_SBOX + 1] =
+{
+  49, 91, 3
+};
+
+#elif SECURITY_BITS == 192
+static const gf aim2_constants[AIM2_NUM_INPUT_SBOX] =
+{
+  {0xc0ac29b7c97c50dd, 0xbe5466cf34e90c6c, 0x452821e638d01377},
+  {0xd1310ba698dfb5ac, 0x9216d5d98979fb1b, 0x3f84d5b5b5470917}
+};
+
+static const uint64_t
+aim2_sbox_exponents[AIM2_NUM_INPUT_SBOX + 1][AIM2_NUM_WORDS_FIELD] =
+{
+  {0xd6ad6b56b5ab5ad5, 0x6ad6b56b5ab5ad5a, 0xad6b56b5ab5ad5ad},
+  {0x7776eeeeeeeeeeed, 0xbbbbbbbb77777777, 0xddddddddddddbbbb},
+  {31, 0, 0}
+};
+
+static const size_t aim2_exponents[AIM2_NUM_INPUT_SBOX + 1] =
+{
+  17, 47, 5
+};
+
+#else
+static const gf aim2_constants[AIM2_NUM_INPUT_SBOX] =
+{
+  {0x24a19947b3916cf7,0xba7c9045f12c7f99,0xb8e1afed6a267e96,0x2ffd72dbd01adfb7},
+  {0x0d95748f728eb658,0xa458fea3f4933d7e,0x636920d871574e69,0x0801f2e2858efc16},
+  {0xc5d1b023286085f0,0x9c30d5392af26013,0x7b54a41dc25a59b5,0x718bcd5882154aee}
+};
+
+static const uint64_t
+aim2_sbox_exponents[AIM2_NUM_INPUT_SBOX + 1][AIM2_NUM_WORDS_FIELD] =
+{
+  {0xdadb5b6b6d6dadb5,0x6b6d6dadb5b6b6d6,0xadb5b6b6d6dadb5b,0xb6d6dadb5b6b6d6d},
+  {0x1112224444889111,0x8891112224444889,0x4448889112222444,0x2224448889112222},
+  {0xeddbb76eddbb76ed,0x76eddbb76eddbb76,0xbb76eddbb76eddbb,0xddbb76eddbb76edd},
+  {7, 0, 0, 0}
+};
+
+static const size_t aim2_exponents[AIM2_NUM_INPUT_SBOX + 1] =
+{
+  11, 141, 7, 3
+};
+
+#endif
+
+#endif // AIM2_CONSTANT_H

data/vendor/AIMer/api.h

@@ -0,0 +1,42 @@
+/*
+NIST-developed software is provided by NIST as a public service. You may use, copy, and distribute copies of the software in any medium, provided that you keep intact this entire notice. You may improve, modify, and create derivative works of the software or any portion of the software, and you may copy and distribute such modifications or works. Modified works should carry a notice stating that you changed the software and should note the date and nature of any such change. Please explicitly acknowledge the National Institute of Standards and Technology as the source of the software.
+
+NIST-developed software is expressly provided "AS IS." NIST MAKES NO WARRANTY OF ANY KIND, EXPRESS, IMPLIED, IN FACT, OR ARISING BY OPERATION OF LAW, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND DATA ACCURACY. NIST NEITHER REPRESENTS NOR WARRANTS THAT THE OPERATION OF THE SOFTWARE WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT ANY DEFECTS WILL BE CORRECTED. NIST DOES NOT WARRANT OR MAKE ANY REPRESENTATIONS REGARDING THE USE OF THE SOFTWARE OR THE RESULTS THEREOF, INCLUDING BUT NOT LIMITED TO THE CORRECTNESS, ACCURACY, RELIABILITY, OR USEFULNESS OF THE SOFTWARE.
+
+You are solely responsible for determining the appropriateness of using and distributing the software and you assume all risks associated with its use, including but not limited to the risks and costs of program errors, compliance with applicable laws, damage to or loss of data, programs or equipment, and the unavailability or interruption of operation. This software is not intended to be used in any situation where a failure could cause risk of injury or damage to property. The software developed by NIST employees is not subject to copyright protection within the United States.
+*/
+
+#ifndef API_H
+#define API_H
+
+#include "params.h"
+#include <stddef.h>
+#include <stdint.h>
+
+#define CRYPTO_PUBLICKEYBYTES AIMER_PK_BYTES
+#define CRYPTO_SECRETKEYBYTES AIMER_SK_BYTES
+#define CRYPTO_BYTES AIMER_SIG_BYTES
+#define CRYPTO_ALGNAME "aimer-" xstr(PARAMS)
+
+#define crypto_sign_keypair AIMER_NAMESPACE(crypto_sign_keypair)
+int crypto_sign_keypair(uint8_t *pk, uint8_t *sk);
+
+#define crypto_sign_signature AIMER_NAMESPACE(crypto_sign_signature)
+int crypto_sign_signature(uint8_t *sig, size_t *siglen,
+                          const uint8_t *m, size_t mlen,
+                          const uint8_t *ctx, size_t ctxlen, const uint8_t *sk);
+
+#define crypto_sign AIMER_NAMESPACE(crypto_sign)
+int crypto_sign(uint8_t *sm, size_t *smlen, const uint8_t *m, size_t mlen,
+                const uint8_t *ctx, size_t ctxlen, const uint8_t *sk);
+
+#define crypto_sign_verify AIMER_NAMESPACE(crypto_sign_verify)
+int crypto_sign_verify(const uint8_t *sig, size_t siglen,
+                       const uint8_t *m, size_t mlen,
+                       const uint8_t *ctx, size_t ctxlen, const uint8_t *pk);
+
+#define crypto_sign_open AIMER_NAMESPACE(crypto_sign_open)
+int crypto_sign_open(uint8_t *m, size_t *mlen, const uint8_t *sm, size_t smlen,
+                     const uint8_t *ctx, size_t ctxlen, const uint8_t *pk);
+
+#endif

data/vendor/AIMer/common/crypto_declassify.h

@@ -0,0 +1,7 @@
+#ifndef PQCLEAN_CRYPTO_DECLASSIFY
+#define PQCLEAN_CRYPTO_DECLASSIFY
+
+/* EMPTY MACRO DEFINITION */
+#define crypto_declassify(x, y)
+
+#endif