pq_crypto 0.4.2 → 0.5.0

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/fips202/native/armv81m/src/keccak_f1600_x4_mve.c

@@ -0,0 +1,136 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+#include "../../../../common.h"
+#include "../../../../ct.h"
+
+#if defined(MLD_FIPS202_ARMV81M_NEED_X4) && \
+    !defined(MLD_CONFIG_MULTILEVEL_NO_SHARED)
+
+#include "fips202_native_armv81m.h"
+
+/*
+ * TEMPORARY: Bit-interleaving using efficient shift-and-mask operations.
+ * TODO: Replace with optimized MVE assembly implementations
+ * (as a part of XORBytes and ExtractBytes)
+ */
+
+/* Extract even-indexed bits from 64-bit value into lower 32 bits */
+static uint32_t bitinterleave_even(uint64_t x)
+{
+  uint64_t t;
+  t = x & 0x5555555555555555ULL;
+  t = (t | (t >> 1)) & 0x3333333333333333ULL;
+  t = (t | (t >> 2)) & 0x0f0f0f0f0f0f0f0fULL;
+  t = (t | (t >> 4)) & 0x00ff00ff00ff00ffULL;
+  t = (t | (t >> 8)) & 0x0000ffff0000ffffULL;
+  t = (t | (t >> 16)) & 0x00000000ffffffffULL;
+  return (uint32_t)t;
+}
+
+/* Extract odd-indexed bits from 64-bit value into lower 32 bits */
+static uint32_t bitinterleave_odd(uint64_t x)
+{
+  return bitinterleave_even(x >> 1);
+}
+
+/* Spread 32-bit value across even bit positions of 64-bit result */
+static uint64_t spread_even(uint32_t x)
+{
+  uint64_t t = x;
+  t = (t | (t << 16)) & 0x0000ffff0000ffffULL;
+  t = (t | (t << 8)) & 0x00ff00ff00ff00ffULL;
+  t = (t | (t << 4)) & 0x0f0f0f0f0f0f0f0fULL;
+  t = (t | (t << 2)) & 0x3333333333333333ULL;
+  t = (t | (t << 1)) & 0x5555555555555555ULL;
+  return t;
+}
+
+/* Combine even and odd 32-bit halves into interleaved 64-bit value */
+static uint64_t bitdeinterleave(uint32_t even, uint32_t odd)
+{
+  return spread_even(even) | (spread_even(odd) << 1);
+}
+
+/*
+ * TEMPORARY: Naive C interleaving functions.
+ * These will be replaced with optimized MVE assembly implementations.
+ */
+static void interleave_4fold(uint64_t *state_4x, const uint64_t *state0,
+                             const uint64_t *state1, const uint64_t *state2,
+                             const uint64_t *state3)
+{
+  uint32_t *state_4xl = (uint32_t *)state_4x;
+  uint32_t *state_4xh = (uint32_t *)state_4x + 100;
+
+  for (size_t i = 0; i < 25; i++)
+  {
+    state_4xl[i * 4 + 0] = bitinterleave_even(state0[i]);
+    state_4xl[i * 4 + 1] = bitinterleave_even(state1[i]);
+    state_4xl[i * 4 + 2] = bitinterleave_even(state2[i]);
+    state_4xl[i * 4 + 3] = bitinterleave_even(state3[i]);
+
+    state_4xh[i * 4 + 0] = bitinterleave_odd(state0[i]);
+    state_4xh[i * 4 + 1] = bitinterleave_odd(state1[i]);
+    state_4xh[i * 4 + 2] = bitinterleave_odd(state2[i]);
+    state_4xh[i * 4 + 3] = bitinterleave_odd(state3[i]);
+  }
+}
+
+static void deinterleave_4fold(uint64_t *state_4x, uint64_t *state0,
+                               uint64_t *state1, uint64_t *state2,
+                               uint64_t *state3)
+{
+  uint32_t *state_4xl = (uint32_t *)state_4x;
+  uint32_t *state_4xh = (uint32_t *)state_4x + 100;
+
+  for (size_t i = 0; i < 25; i++)
+  {
+    state0[i] = bitdeinterleave(state_4xl[i * 4 + 0], state_4xh[i * 4 + 0]);
+    state1[i] = bitdeinterleave(state_4xl[i * 4 + 1], state_4xh[i * 4 + 1]);
+    state2[i] = bitdeinterleave(state_4xl[i * 4 + 2], state_4xh[i * 4 + 2]);
+    state3[i] = bitdeinterleave(state_4xl[i * 4 + 3], state_4xh[i * 4 + 3]);
+  }
+}
+
+#define mld_keccak_f1600_x4_native_impl \
+  MLD_NAMESPACE(keccak_f1600_x4_native_impl)
+int mld_keccak_f1600_x4_native_impl(uint64_t *state)
+{
+  /*
+   * TEMPORARY: Bit-interleaving using efficient shift-and-mask operations.
+   * TODO: Replace with optimized MVE assembly implementations
+   * (as a part of XORBytes and ExtractBytes)
+   */
+  MLD_ALIGN uint64_t state_4x[100];
+  MLD_ALIGN uint64_t state_4x_tmp[100];
+
+  /* Interleave the 4 states into bit-interleaved format */
+  interleave_4fold(state_4x, &state[0], &state[25], &state[50], &state[75]);
+
+  /* Run the permutation */
+  mld_keccak_f1600_x4_mve_asm(state_4x, state_4x_tmp,
+                              mld_keccakf1600_round_constants);
+
+  /* Deinterleave back to 4 separate states */
+  deinterleave_4fold(state_4x, &state[0], &state[25], &state[50], &state[75]);
+
+  mld_zeroize(state_4x, sizeof(state_4x));
+  mld_zeroize(state_4x_tmp, sizeof(state_4x_tmp));
+  return MLD_NATIVE_FUNC_SUCCESS;
+}
+
+#else /* MLD_FIPS202_ARMV81M_NEED_X4 && !MLD_CONFIG_MULTILEVEL_NO_SHARED */
+
+MLD_EMPTY_CU(keccak_f1600_x4_mve)
+
+#endif /* !(MLD_FIPS202_ARMV81M_NEED_X4 && !MLD_CONFIG_MULTILEVEL_NO_SHARED) \
+        */
+
+/* To facilitate single-compilation-unit (SCU) builds, undefine all macros.
+ * Don't modify by hand -- this is auto-generated by scripts/autogen. */
+/* Some macros are kept because they are also defined in a header. */
+/* Keep: mld_keccak_f1600_x4_native_impl (mve.h) */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/fips202/native/armv81m/src/keccakf1600_round_constants.c

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+#include "../../../../common.h"
+
+#if defined(MLD_FIPS202_ARMV81M_NEED_X4) && \
+    !defined(MLD_CONFIG_MULTILEVEL_NO_SHARED)
+
+#include "fips202_native_armv81m.h"
+
+/*
+ * Keccak round constants in bit-interleaved form.
+ * Each 64-bit constant is split into two 32-bit words:
+ * - low word contains even-indexed bits
+ * - high word contains odd-indexed bits
+ */
+MLD_ALIGN const uint32_t mld_keccakf1600_round_constants[48] = {
+    0x00000001, 0x00000000, /* RC0 */
+    0x00000000, 0x00000089, /* RC1 */
+    0x00000000, 0x8000008b, /* RC2 */
+    0x00000000, 0x80008080, /* RC3 */
+    0x00000001, 0x0000008b, /* RC4 */
+    0x00000001, 0x00008000, /* RC5 */
+    0x00000001, 0x80008088, /* RC6 */
+    0x00000001, 0x80000082, /* RC7 */
+    0x00000000, 0x0000000b, /* RC8 */
+    0x00000000, 0x0000000a, /* RC9 */
+    0x00000001, 0x00008082, /* RC10 */
+    0x00000000, 0x00008003, /* RC11 */
+    0x00000001, 0x0000808b, /* RC12 */
+    0x00000001, 0x8000000b, /* RC13 */
+    0x00000001, 0x8000008a, /* RC14 */
+    0x00000001, 0x80000081, /* RC15 */
+    0x00000000, 0x80000081, /* RC16 */
+    0x00000000, 0x80000008, /* RC17 */
+    0x00000000, 0x00000083, /* RC18 */
+    0x00000000, 0x80008003, /* RC19 */
+    0x00000001, 0x80008088, /* RC20 */
+    0x00000000, 0x80000088, /* RC21 */
+    0x00000001, 0x00008000, /* RC22 */
+    0x00000000, 0x80008082, /* RC23 */
+};
+
+#else /* MLD_FIPS202_ARMV81M_NEED_X4 && !MLD_CONFIG_MULTILEVEL_NO_SHARED */
+
+MLD_EMPTY_CU(fips202_armv81m_round_constants)
+
+#endif /* !(MLD_FIPS202_ARMV81M_NEED_X4 && !MLD_CONFIG_MULTILEVEL_NO_SHARED) \
+        */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/fips202/native/auto.h

@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+#ifndef MLD_FIPS202_NATIVE_AUTO_H
+#define MLD_FIPS202_NATIVE_AUTO_H
+
+/*
+ * Default FIPS202 backend
+ */
+#include "../../sys.h"
+
+#if defined(MLD_SYS_AARCH64)
+#include "aarch64/auto.h"
+#endif
+
+#if defined(MLD_SYS_X86_64) && defined(MLD_SYS_X86_64_AVX2)
+#include "x86_64/xkcp.h"
+#endif
+
+/* We do not yet include the FIPS202 backend for Armv8.1-M+MVE by default
+ * as it is still experimental and undergoing review. */
+/* #if defined(MLD_SYS_ARMV81M_MVE) */
+/* #include "armv81m/mve.h" */
+/* #endif */
+
+#endif /* !MLD_FIPS202_NATIVE_AUTO_H */