kpqc 0.1.1 → 0.2.0

data/vendor/AIMer/aim3.c

@@ -0,0 +1,227 @@
+// SPDX-License-Identifier: MIT
+
+#include "aim3.h"
+#include "field.h"
+#include "hash.h"
+#include "params.h"
+#include <stddef.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+static void squeeze_invertible_matrix(hash_instance *ctx,
+                                      gf mat[AIM3_NUM_BITS_FIELD])
+{
+  uint8_t buf[AIM3_NUM_BYTES_FIELD];
+  uint64_t ormask, lmask, umask;
+
+  gf matrix_L[AIM3_NUM_BITS_FIELD];
+  gf matrix_U[AIM3_NUM_BITS_FIELD];
+  gf temp = {0,};
+
+  for (size_t row = 0; row < AIM3_NUM_BITS_FIELD; row++)
+  {
+    hash_squeeze(ctx, buf, AIM3_NUM_BYTES_FIELD);
+    gf_from_bytes(temp, buf);
+
+    ormask = ((uint64_t)1) << (row % 64);
+    lmask = ((uint64_t)-1) << (row % 64);
+    umask = ~lmask;
+
+    size_t inter = row / 64;
+    size_t col_word;
+    for (col_word = 0; col_word < inter; col_word++)
+    {
+      // L is zero, U is full
+      matrix_L[row][col_word] = 0;
+      matrix_U[row][col_word] = temp[col_word];
+    }
+    matrix_L[row][inter] = (temp[inter] & lmask) | ormask;
+    matrix_U[row][inter] = (temp[inter] & umask) | ormask;
+    for (col_word = inter + 1; col_word < AIM3_NUM_WORDS_FIELD; col_word++)
+    {
+      // L is full, U is zero
+      matrix_L[row][col_word] = temp[col_word];
+      matrix_U[row][col_word] = 0;
+    }
+  }
+
+  for (size_t i = 0; i < AIM3_NUM_BITS_FIELD; i++)
+  {
+    gf_mat_vec_mul(mat[i], matrix_U[i], (const gf *)matrix_L);
+  }
+}
+
+void aim3_generate_linear(aim_lin_t *lin, const uint8_t iv[AIM3_IV_SIZE])
+{
+  hash_instance ctx;
+
+  hash_init(&ctx);
+  hash_update(&ctx, iv, AIM3_IV_SIZE);
+  hash_final(&ctx);
+
+  for (size_t ell = 0; ell < 2 * AIM3_NUM_INPUT_SBOX; ell++)
+  {
+    squeeze_invertible_matrix(&ctx, lin->mat_A[ell]);
+  }
+
+  for (size_t ell = 0; ell < AIM3_NUM_INPUT_SBOX + 1; ell++)
+  {
+    hash_squeeze(&ctx, (uint8_t *)lin->vec_b[ell], AIM3_NUM_BYTES_FIELD);
+  }
+  hash_ctx_release(&ctx);
+}
+
+int aim3_nozeroinpsb(uint8_t ct[AIM3_NUM_BYTES_FIELD],
+                     const uint8_t pt[AIM3_NUM_BYTES_FIELD],
+                     const uint8_t iv[AIM3_IV_SIZE])
+{
+  aim_lin_t *lin = (aim_lin_t *)malloc(sizeof(aim_lin_t));
+  if (lin == NULL)
+  {
+    // allocation failure
+    return -2;
+  }
+
+  gf state[AIM3_NUM_INPUT_SBOX];
+  gf pt_gf = {0,}, ct_gf = {0,}, tmp = {0,};
+  gf_from_bytes(pt_gf, pt);
+
+  // generate random matrix
+  aim3_generate_linear(lin, iv);
+
+  for (size_t i = 0; i < AIM3_NUM_INPUT_SBOX; i++)
+  {
+    // linear component: affine layer
+    gf_mat_vec_mul(state[i], pt_gf, lin->mat_A[i]);
+    gf_add(state[i], state[i], lin->vec_b[i]);
+
+    // non-linear component: y = x^{2^e-1} + x^{-1} = x^{-1} * (x^2^e + 1)
+    if (gf_is0(state[i]))
+    {
+      free(lin);
+      return -1;
+    }
+    gf_inv(tmp, state[i]);
+    for (size_t e = 0; e < aim3_exponents[i]; e++)
+    {
+      gf_sqr(state[i], state[i]);
+    }
+    state[i][0] ^= 1;
+    gf_mul(state[i], state[i], tmp);
+
+    // linear component: affine layer
+    gf_mat_vec_mul(state[i], state[i],
+                   (const gf *)lin->mat_A[i + AIM3_NUM_INPUT_SBOX]);
+  }
+
+  for (size_t i = 1; i < AIM3_NUM_INPUT_SBOX; i++)
+  {
+    gf_add(state[0], state[0], state[i]);
+  }
+  gf_add(state[0], state[0], lin->vec_b[AIM3_NUM_INPUT_SBOX]);
+
+  // non-linear component: y = x^{2^e-1} + x^{-1} = x^{-1} * (x^2^e + 1)
+  if (gf_is0(state[0]))
+  {
+    free(lin);
+    return -1;
+  }
+  gf_inv(tmp, state[0]);
+  for (size_t e = 0; e < aim3_exponents[AIM3_NUM_INPUT_SBOX]; e++)
+  {
+    gf_sqr(state[0], state[0]);
+  }
+  state[0][0] ^= 1;
+  gf_mul(state[0], state[0], tmp);
+
+  // linear component: feed-forward
+  gf_add(ct_gf, pt_gf, state[0]);
+
+  gf_to_bytes(ct, ct_gf);
+
+  free(lin);
+  return 0;
+}
+
+void aim3_sbox_outputs(gf sbox_outputs[AIM3_NUM_INPUT_SBOX+1],
+                       const aim_lin_t* lin,
+                       const gf pt, const gf ct)
+{
+  gf tmp = {0,};
+  for (size_t i = 0; i < AIM3_NUM_INPUT_SBOX; i ++)
+  {
+    // linear component: affine layer
+    gf_mat_vec_mul(sbox_outputs[i], pt, lin->mat_A[i]);
+    gf_add(sbox_outputs[i], sbox_outputs[i], lin->vec_b[i]);
+
+    // non-linear component: y = x^{2^e-1} + x^{-1} = x^{-1} * (x^2^e + 1)
+    gf_inv(tmp, sbox_outputs[i]);
+    for (size_t e = 0; e < aim3_exponents[i]; e++)
+    {
+      gf_sqr(sbox_outputs[i], sbox_outputs[i]);
+    }
+    sbox_outputs[i][0] ^= 1;
+    gf_mul(sbox_outputs[i], sbox_outputs[i], tmp);
+  }
+  gf_add(sbox_outputs[AIMER_L], pt, ct);
+}
+
+void aim3_mpc(mult_chk_t *mult_chk, const aim_lin_t *lin,
+              const tape_t *tape, const gf ct_gf,
+              size_t party)
+{
+  for (size_t i = 0; i < AIMER_L + 1; i++)
+  {
+    gf_copy(mult_chk->a_shares[i], tape->a_shares[i]);
+  }
+
+  // b_shares[i] = share of sbox outputs
+  for (size_t i = 0; i < AIMER_L; i++)
+  {
+    gf_copy(mult_chk->b_shares[i], tape->y_shares[i]);
+  }
+  gf_copy(mult_chk->b_shares[AIMER_L], tape->pt_share);
+  if (party == AIMER_N - 1)
+  {
+    gf_add(mult_chk->b_shares[AIMER_L], mult_chk->b_shares[AIMER_L], ct_gf);
+  }
+
+  gf_copy(mult_chk->c_share, tape->c_share);
+
+  // Set x_shares (= share of sbox inputs)
+  for (size_t i = 0; i < AIMER_L; i++)
+  {
+    gf_mat_vec_mul(mult_chk->x_shares[i], tape->pt_share, lin->mat_A[i]);
+    if (party == AIMER_N - 1)
+    {
+      gf_add(mult_chk->x_shares[i], mult_chk->x_shares[i], lin->vec_b[i]);
+    }
+  }
+
+  gf_set0(mult_chk->x_shares[AIMER_L]);
+  for (size_t ell = 0; ell < AIMER_L; ell++)
+  {
+    gf_mat_vec_mul_add(mult_chk->x_shares[AIMER_L], tape->y_shares[ell],
+                       lin->mat_A[ell+AIMER_L]);
+  }
+  if (party == AIMER_N - 1)
+  {
+    gf_add(mult_chk->x_shares[AIMER_L], mult_chk->x_shares[AIMER_L],
+           lin->vec_b[AIMER_L]);
+  }
+
+  // Set z_shares: z[i] = x[i]^{2^e} + 1
+  // y = x^{-1} + x^{2^e-1} -> xy = x^{2^e} + 1
+  for (size_t ell = 0; ell < AIMER_L + 1; ell++)
+  {
+    gf_sqr(mult_chk->z_shares[ell], mult_chk->x_shares[ell]);
+    for (size_t i = 1; i < aim3_exponents[ell]; i++)
+    {
+      gf_sqr(mult_chk->z_shares[ell], mult_chk->z_shares[ell]);
+    }
+    if (party == AIMER_N - 1)
+    {
+      mult_chk->z_shares[ell][0] ^= 1;
+    }
+  }
+}

data/vendor/AIMer/aim3.h

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: MIT
+
+#ifndef AIM3_H
+#define AIM3_H
+
+#include "field.h"
+#include "params.h"
+#include "sign.h"
+#include <stdint.h>
+
+typedef struct mult_chk_t
+{
+  gf x_shares[AIMER_L + 1];
+  gf z_shares[AIMER_L + 1];
+  gf a_shares[AIMER_L + 1];
+  gf b_shares[AIMER_L + 1]; // b_shares[i] = y_shares[i]
+  gf c_share;
+} mult_chk_t;
+
+typedef struct aim_lin_t
+{
+  gf mat_A[2 * AIM3_NUM_INPUT_SBOX][AIM3_NUM_BITS_FIELD];
+  gf vec_b[AIM3_NUM_INPUT_SBOX + 1];
+} aim_lin_t;
+
+#if SECURITY_BITS == 128
+static const size_t aim3_exponents[AIM3_NUM_INPUT_SBOX + 1] =
+{
+  3, 7, 11
+};
+
+#elif SECURITY_BITS == 192
+static const size_t aim3_exponents[AIM3_NUM_INPUT_SBOX + 1] =
+{
+  11, 23, 47
+};
+
+#else
+static const size_t aim3_exponents[AIM3_NUM_INPUT_SBOX + 1] =
+{
+  3, 7, 11, 19
+};
+#endif
+
+#define aim3_generate_linear AIMER_NAMESPACE(aim3_generate_linear)
+void aim3_generate_linear(aim_lin_t *lin, const uint8_t iv[AIM3_IV_SIZE]);
+
+#define aim3_sbox_outputs AIMER_NAMESPACE(aim3_sbox_outputs)
+void aim3_sbox_outputs(gf sbox_outputs[AIM3_NUM_INPUT_SBOX+1],
+                       const aim_lin_t *lin,
+                       const gf pt, const gf ct);
+
+#define aim3_nozeroinpsb AIMER_NAMESPACE(aim3_nozeroinpsb)
+int aim3_nozeroinpsb(uint8_t ct[AIM3_NUM_BYTES_FIELD],
+                     const uint8_t pt[AIM3_NUM_BYTES_FIELD],
+                     const uint8_t iv[AIM3_IV_SIZE]);
+
+#define aim3_mpc AIMER_NAMESPACE(aim3_mpc)
+void aim3_mpc(mult_chk_t *mult_chk, const aim_lin_t *lin,
+              const tape_t *tape, const gf ct_gf,
+              size_t party);
+
+#endif // AIM3_H

data/vendor/AIMer/field.h

@@ -4,9 +4,15 @@
 #define FIELD_H
 
 #include "params.h"
+#include <stdbool.h>
 #include <stddef.h>
 #include <stdint.h>
 
+#if defined(__BYTE_ORDER__) && defined(__ORDER_BIG_ENDIAN__) && \
+    __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+#error "AIMer reference implementation assumes a little-endian target"
+#endif
+
 #if SECURITY_BITS == 128
 typedef uint64_t gf[2];
 #elif SECURITY_BITS == 192
@@ -17,6 +23,8 @@ typedef uint64_t gf[4];
 
 #define gf_set0 AIMER_NAMESPACE(gf_set0)
 void gf_set0(gf a);
+#define gf_is0 AIMER_NAMESPACE(gf_is0)
+bool gf_is0(const gf a);
 #define gf_copy AIMER_NAMESPACE(gf_copy)
 void gf_copy(gf out, const gf in);
 #define gf_to_bytes AIMER_NAMESPACE(gf_to_bytes)
@@ -32,12 +40,12 @@ void gf_mul(gf c, const gf a, const gf b);
 void gf_mul_add(gf c, const gf a, const gf b);
 #define gf_sqr AIMER_NAMESPACE(gf_sqr)
 void gf_sqr(gf c, const gf a);
-#define gf_exp AIMER_NAMESPACE(gf_exp)
-void gf_exp(gf out, const gf in, const uint64_t *exp);
+#define gf_inv AIMER_NAMESPACE(gf_inv)
+void gf_inv(gf c, const gf a);
 
 #define gf_mat_vec_mul AIMER_NAMESPACE(gf_mat_vec_mul)
-void gf_mat_vec_mul(gf c, const gf a, const gf b[AIM2_NUM_BITS_FIELD]);
+void gf_mat_vec_mul(gf c, const gf a, const gf b[AIM3_NUM_BITS_FIELD]);
 #define gf_mat_vec_mul_add AIMER_NAMESPACE(gf_mat_vec_mul_add)
-void gf_mat_vec_mul_add(gf c, const gf a, const gf b[AIM2_NUM_BITS_FIELD]);
+void gf_mat_vec_mul_add(gf c, const gf a, const gf b[AIM3_NUM_BITS_FIELD]);
 
 #endif // FIELD_H