pq_crypto 0.6.5 → 0.6.7

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/poly.c

@@ -167,16 +167,18 @@ void mld_poly_shiftl(mld_poly *a)
 static MLD_INLINE int32_t mld_fqmul(int32_t a, int32_t b)
 __contract__(
   requires(b > -MLDSA_Q_HALF && b < MLDSA_Q_HALF)
-  ensures(return_value > -MLDSA_Q && return_value < MLDSA_Q)
+  ensures(return_value > -MLD_FQMUL_BOUND && return_value < MLD_FQMUL_BOUND)
 )
 {
-  /* Bounds: We argue in mld_montgomery_reduce() that the reult
+  /* Bounds: We argue in mld_montgomery_reduce() that the result
    * of Montgomery reduction is < MLDSA_Q if the input is smaller
    * than 2^31 * MLDSA_Q in absolute value. Indeed, we have:
    *
    *    |a * b|   = |a| * |b|
    *              < 2^31 * MLDSA_Q_HALF
    *              < 2^31 * MLDSA_Q
+   *
+   * So the output is < MLDSA_Q < MLD_FQMUL_BOUND.
    */
   return mld_montgomery_reduce((int64_t)a * (int64_t)b);
 }
@@ -215,17 +217,17 @@ static MLD_INLINE void mld_ntt_butterfly_block(int32_t r[MLDSA_N],
                                                const int32_t zeta,
                                                const unsigned start,
                                                const unsigned len,
-                                               const unsigned bound)
+                                               const uint32_t bound)
 __contract__(
   requires(start < MLDSA_N)
   requires(1 <= len && len <= MLDSA_N / 2 && start + 2 * len <= MLDSA_N)
-  requires(0 <= bound && bound < INT32_MAX - MLDSA_Q)
+  requires(0 <= bound && bound < INT32_MAX - MLD_FQMUL_BOUND)
   requires(-MLDSA_Q_HALF < zeta && zeta < MLDSA_Q_HALF)
   requires(memory_no_alias(r, sizeof(int32_t) * MLDSA_N))
-  requires(array_abs_bound(r, 0, start, bound + MLDSA_Q))
+  requires(array_abs_bound(r, 0, start, bound + MLD_FQMUL_BOUND))
   requires(array_abs_bound(r, start, MLDSA_N, bound))
   assigns(memory_slice(r, sizeof(int32_t) * MLDSA_N))
-  ensures(array_abs_bound(r, 0, start + 2*len, bound + MLDSA_Q))
+  ensures(array_abs_bound(r, 0, start + 2*len, bound + MLD_FQMUL_BOUND))
   ensures(array_abs_bound(r, start + 2 * len, MLDSA_N, bound)))
 {
   /* `bound` is a ghost variable only needed in the CBMC specification */
@@ -238,9 +240,9 @@ __contract__(
      * Coefficients are updated in strided pairs, so the bounds for the
      * intermediate states alternate twice between the old and new bound
      */
-    invariant(array_abs_bound(r, 0,           j,           bound + MLDSA_Q))
+    invariant(array_abs_bound(r, 0,           j,           bound + MLD_FQMUL_BOUND))
     invariant(array_abs_bound(r, j,           start + len, bound))
-    invariant(array_abs_bound(r, start + len, j + len,     bound + MLDSA_Q))
+    invariant(array_abs_bound(r, start + len, j + len,     bound + MLD_FQMUL_BOUND))
     invariant(array_abs_bound(r, j + len,     MLDSA_N,     bound))
     decreases(start + len - j))
   {
@@ -265,9 +267,9 @@ static MLD_INLINE void mld_ntt_layer(int32_t r[MLDSA_N], const unsigned layer)
 __contract__(
   requires(memory_no_alias(r, sizeof(int32_t) * MLDSA_N))
   requires(1 <= layer && layer <= 8)
-  requires(array_abs_bound(r, 0, MLDSA_N, layer * MLDSA_Q))
+  requires(array_abs_bound(r, 0, MLDSA_N, layer * MLD_FQMUL_BOUND))
   assigns(memory_slice(r, sizeof(int32_t) * MLDSA_N))
-  ensures(array_abs_bound(r, 0, MLDSA_N, (layer + 1) * MLDSA_Q)))
+  ensures(array_abs_bound(r, 0, MLDSA_N, (layer + 1) * MLD_FQMUL_BOUND)))
 {
   unsigned start, k, len;
   /* Twiddle factors for layer n are at indices 2^(n-1)..2^n-1. */
@@ -278,12 +280,12 @@ __contract__(
     invariant(start < MLDSA_N + 2 * len)
     invariant(k <= MLDSA_N)
     invariant(2 * len * k == start + MLDSA_N)
-    invariant(array_abs_bound(r, 0, start, layer * MLDSA_Q + MLDSA_Q))
-    invariant(array_abs_bound(r, start, MLDSA_N, layer * MLDSA_Q))
+    invariant(array_abs_bound(r, 0, start, layer * MLD_FQMUL_BOUND + MLD_FQMUL_BOUND))
+    invariant(array_abs_bound(r, start, MLDSA_N, layer * MLD_FQMUL_BOUND))
     decreases(MLDSA_N - start))
   {
     int32_t zeta = mld_zetas[k++];
-    mld_ntt_butterfly_block(r, zeta, start, len, layer * MLDSA_Q);
+    mld_ntt_butterfly_block(r, zeta, start, len, layer * MLD_FQMUL_BOUND);
   }
 }
 
@@ -305,7 +307,7 @@ __contract__(
   for (layer = 1; layer < 9; layer++)
   __loop__(
     invariant(1 <= layer && layer <= 9)
-    invariant(array_abs_bound(r, 0, MLDSA_N, layer * MLDSA_Q))
+    invariant(array_abs_bound(r, 0, MLDSA_N, layer * MLD_FQMUL_BOUND))
     decreases(9 - layer)
   )
   {
@@ -377,13 +379,18 @@ __contract__(
     unsigned j;
     int32_t zeta = -mld_zetas[k--];
 
+    /* The bound `(MLDSA_N >> (layer - 1)) * MLDSA_Q` is loose enough to
+     * cover both the input bound `(MLDSA_N >> layer) * MLDSA_Q`
+     * (for layers >= 1) and the fqmul output bound `MLD_FQMUL_BOUND`
+     * (which is < 2 * MLDSA_Q <= (MLDSA_N >> (layer - 1)) * MLDSA_Q). */
     for (j = start; j < start + len; j++)
     __loop__(
       invariant(start <= j && j <= start + len)
       invariant(array_abs_bound(r, 0, start, (MLDSA_N >> (layer - 1)) * MLDSA_Q))
       invariant(array_abs_bound(r, start, j, (MLDSA_N >> (layer - 1)) * MLDSA_Q))
       invariant(array_abs_bound(r, j, start + len, (MLDSA_N >> layer) * MLDSA_Q))
-      invariant(array_abs_bound(r, start + len, MLDSA_N, (MLDSA_N >> layer) * MLDSA_Q))
+      invariant(array_abs_bound(r, start + len, j + len, (MLDSA_N >> (layer - 1)) * MLDSA_Q))
+      invariant(array_abs_bound(r, j + len, MLDSA_N, (MLDSA_N >> layer) * MLDSA_Q))
       decreases(start + len - j))
     {
       int32_t t = r[j];
@@ -998,6 +1005,58 @@ uint32_t mld_poly_chknorm(const mld_poly *a, int32_t B)
   return mld_poly_chknorm_c(a, B);
 }
 
+#if !defined(MLD_CONFIG_NO_SIGN_API) || !defined(MLD_CONFIG_NO_VERIFY_API)
+#if defined(MLD_CONFIG_MULTILEVEL_WITH_SHARED) || \
+    MLD_CONFIG_PARAMETER_SET == 44
+MLD_INTERNAL_API
+void mld_polyw1_pack_88(uint8_t r[MLDSA_POLYW1_PACKEDBYTES_88],
+                        const mld_poly *a)
+{
+  unsigned int i;
+
+  mld_assert_bound(a->coeffs, MLDSA_N, 0,
+                   (MLDSA_Q - 1) / (2 * MLDSA_GAMMA2_88));
+
+  for (i = 0; i < MLDSA_N / 4; ++i)
+  __loop__(
+    invariant(i <= MLDSA_N/4)
+    decreases(MLDSA_N / 4 - i))
+  {
+    r[3 * i + 0] = (uint8_t)((a->coeffs[4 * i + 0]) & 0xFF);
+    r[3 * i + 0] |= (uint8_t)((a->coeffs[4 * i + 1] << 6) & 0xFF);
+    r[3 * i + 1] = (uint8_t)((a->coeffs[4 * i + 1] >> 2) & 0xFF);
+    r[3 * i + 1] |= (uint8_t)((a->coeffs[4 * i + 2] << 4) & 0xFF);
+    r[3 * i + 2] = (uint8_t)((a->coeffs[4 * i + 2] >> 4) & 0xFF);
+    r[3 * i + 2] |= (uint8_t)((a->coeffs[4 * i + 3] << 2) & 0xFF);
+  }
+}
+#endif /* MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET == 44 \
+        */
+
+#if defined(MLD_CONFIG_MULTILEVEL_WITH_SHARED) || \
+    (MLD_CONFIG_PARAMETER_SET == 65 || MLD_CONFIG_PARAMETER_SET == 87)
+MLD_INTERNAL_API
+void mld_polyw1_pack_32(uint8_t r[MLDSA_POLYW1_PACKEDBYTES_32],
+                        const mld_poly *a)
+{
+  unsigned int i;
+
+  mld_assert_bound(a->coeffs, MLDSA_N, 0,
+                   (MLDSA_Q - 1) / (2 * MLDSA_GAMMA2_32));
+
+  for (i = 0; i < MLDSA_N / 2; ++i)
+  __loop__(
+    invariant(i <= MLDSA_N/2)
+    decreases(MLDSA_N / 2 - i))
+  {
+    r[i] =
+        (uint8_t)((a->coeffs[2 * i + 0] | (a->coeffs[2 * i + 1] << 4)) & 0xFF);
+  }
+}
+#endif /* MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET == 65 \
+          || MLD_CONFIG_PARAMETER_SET == 87 */
+#endif /* !MLD_CONFIG_NO_SIGN_API || !MLD_CONFIG_NO_VERIFY_API */
+
 #else  /* !MLD_CONFIG_MULTILEVEL_NO_SHARED */
 MLD_EMPTY_CU(mld_poly)
 #endif /* MLD_CONFIG_MULTILEVEL_NO_SHARED */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/poly.h

@@ -2,6 +2,16 @@
  * Copyright (c) The mldsa-native project authors
  * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
  */
+
+/* References
+ * ==========
+ *
+ * - [FIPS204]
+ *   FIPS 204 Module-Lattice-Based Digital Signature Standard
+ *   National Institute of Standards and Technology
+ *   https://csrc.nist.gov/pubs/fips/204/final
+ */
+
 #ifndef MLD_POLY_H
 #define MLD_POLY_H
 
@@ -10,8 +20,10 @@
 #include "reduce.h"
 #include "rounding.h"
 
+/* Absolute exclusive upper bound for the output of fqmul */
+#define MLD_FQMUL_BOUND ((5 * MLDSA_Q + 3) / 4)
 /* Absolute exclusive upper bound for the output of the forward NTT */
-#define MLD_NTT_BOUND (9 * MLDSA_Q)
+#define MLD_NTT_BOUND (9 * MLD_FQMUL_BOUND)
 /* Absolute exclusive upper bound for the output of the inverse NTT*/
 #define MLD_INTT_BOUND MLDSA_Q
 
@@ -62,6 +74,9 @@ __contract__(
 /**
  * Add polynomials. No modular reduction is performed.
  *
+ * @spec{Implements @[FIPS204, Algorithm 44, AddNTT] (coefficientwise
+ * polynomial addition; also used for addition in the normal domain).}
+ *
  * @param[in,out] r Pointer to input-output polynomial to be added to.
  * @param[in]     b Pointer to input polynomial that should be added to r.
  *                  Must be disjoint from r.
@@ -131,7 +146,10 @@ __contract__(
 
 #define mld_poly_ntt MLD_NAMESPACE(poly_ntt)
 /**
- * In-place forward NTT. Coefficients can grow by 8*MLDSA_Q in absolute value.
+ * In-place forward NTT. Output coefficients are bounded by MLD_NTT_BOUND in
+ * absolute value.
+ *
+ * @spec{Implements @[FIPS204, Algorithm 41, NTT].}
  *
  * @param[in,out] a Pointer to input/output polynomial.
  */
@@ -147,11 +165,16 @@ __contract__(
 
 #define mld_poly_invntt_tomont MLD_NAMESPACE(poly_invntt_tomont)
 /**
- * In-place inverse NTT and multiplication by 2^{32}.
+ * In-place inverse NTT.
  *
  * Input coefficients need to be less than MLDSA_Q in absolute value and
  * output coefficients are bounded by MLD_INTT_BOUND.
  *
+ * @spec{Implements @[FIPS204, Algorithm 42, NTT^{-1}] up to scaling:
+ * The input is scaled by 2^{-32} as a result of the Montgomery base
+ * multiplication. The output is in normal domain. In other words, this
+ * function implements `NTT^{-1} o mult(2^32)`.}
+ *
  * @param[in,out] a Pointer to input/output polynomial.
  */
 MLD_INTERNAL_API
@@ -167,9 +190,12 @@ __contract__(
     defined(MLD_CONFIG_REDUCE_RAM) || defined(MLD_UNIT_TEST)
 #define mld_poly_pointwise_montgomery MLD_NAMESPACE(poly_pointwise_montgomery)
 /**
- * Pointwise multiplication of polynomials in NTT domain representation and
- * multiplication of resulting polynomial by 2^{-32}. Destructive in the first
- * argument.
+ * Pointwise multiplication of polynomials. Destructive in the first argument.
+ *
+ * @spec{Implements @[FIPS204, Algorithm 45, MultiplyNTT], up to scaling: The
+ * input is in normal domain, the output is scaled by 2^{-32} as a result of
+ * the use of Montgomery multiplication. In other words, this function
+ * implements `mult(2^{-32}) o MultiplyNTT`.}
  *
  * @param[in,out] a Pointer to first input/output polynomial. On entry, holds
  *                  the first multiplicand; on exit, holds the product
@@ -222,6 +248,8 @@ __contract__(
  * Sample polynomial with uniformly random coefficients in [0, MLDSA_Q-1] by
  * performing rejection sampling on the output stream of SHAKE128(seed|nonce).
  *
+ * @spec{Implements @[FIPS204, Algorithm 30, RejNTTPoly].}
+ *
  * @param[out] a    Pointer to output polynomial.
  * @param[in]  seed Byte array with seed of length MLDSA_SEEDBYTES and the
  *                  packed 2-byte nonce.
@@ -242,6 +270,8 @@ __contract__(
  * Generate four polynomials using rejection sampling on (pseudo-)uniformly
  * random bytes sampled from a seed.
  *
+ * @spec{Implements @[FIPS204, Algorithm 30, RejNTTPoly] (four-way batched).}
+ *
  * @param[out] vec0 Pointer to first polynomial to be sampled.
  * @param[out] vec1 Pointer to second polynomial to be sampled.
  * @param[out] vec2 Pointer to third polynomial to be sampled.
@@ -277,6 +307,8 @@ __contract__(
  * Bit-pack polynomial t1 with coefficients fitting in 10 bits. Input
  * coefficients are assumed to be standard representatives.
  *
+ * @spec{Implements @[FIPS204, Algorithm 16, SimpleBitPack].}
+ *
  * @param[out] r Pointer to output byte array with at least
  *               MLDSA_POLYT1_PACKEDBYTES bytes.
  * @param[in]  a Pointer to input polynomial.
@@ -297,6 +329,8 @@ __contract__(
  * Unpack polynomial t1 with 10-bit coefficients. Output coefficients are
  * standard representatives.
  *
+ * @spec{Implements @[FIPS204, Algorithm 18, SimpleBitUnpack].}
+ *
  * @param[out] r Pointer to output polynomial.
  * @param[in]  a Byte array with bit-packed polynomial.
  */
@@ -315,6 +349,8 @@ __contract__(
 /**
  * Bit-pack polynomial t0 with coefficients in ]-2^{MLDSA_D-1}, 2^{MLDSA_D-1}].
  *
+ * @spec{Implements @[FIPS204, Algorithm 17, BitPack].}
+ *
  * @param[out] r Pointer to output byte array with at least
  *               MLDSA_POLYT0_PACKEDBYTES bytes.
  * @param[in]  a Pointer to input polynomial.
@@ -334,6 +370,8 @@ __contract__(
 /**
  * Unpack polynomial t0 with coefficients in ]-2^{MLDSA_D-1}, 2^{MLDSA_D-1}].
  *
+ * @spec{Implements @[FIPS204, Algorithm 19, BitUnpack].}
+ *
  * @param[out] r Pointer to output polynomial.
  * @param[in]  a Byte array with bit-packed polynomial.
  */
@@ -352,11 +390,12 @@ __contract__(
  * Check infinity norm of polynomial against given bound. Assumes input
  * coefficients were reduced by mld_reduce32().
  *
- * @spec{The definition in FIPS-204 requires signed canonical reduction prior
- * to applying the bounds check. However, `-B < (a mod± MLDSA_Q) < B` is
- * equivalent to `-B < a < B` under the assumption that
- * `B <= MLDSA_Q - MLD_REDUCE32_RANGE_MAX` (cf. the assertion in the code).
- * Hence, the present spec and implementation are correct without reduction.}
+ * @spec{@[FIPS204] defines the infinity norm via signed canonical reduction
+ * (mod± MLDSA_Q) prior to applying the bounds check. However,
+ * `-B < (a mod± MLDSA_Q) < B` is equivalent to `-B < a < B` under the
+ * assumption that `B <= MLDSA_Q - MLD_REDUCE32_RANGE_MAX` (cf. the assertion in
+ * the code). Hence, this contract and implementation are correct without
+ * reduction.}
  *
  * @param[in] a Pointer to polynomial.
  * @param     B Norm bound.
@@ -375,4 +414,51 @@ __contract__(
   ensures((return_value == 0) == array_abs_bound(a->coeffs, 0, MLDSA_N, B))
 );
 
+#if !defined(MLD_CONFIG_NO_SIGN_API) || !defined(MLD_CONFIG_NO_VERIFY_API)
+#if defined(MLD_CONFIG_MULTILEVEL_WITH_SHARED) || MLD_CONFIG_PARAMETER_SET == 44
+#define mld_polyw1_pack_88 MLD_NAMESPACE(polyw1_pack_88)
+/**
+ * Bit-pack polynomial w1, using 6 bits per coefficient.
+ * This is the variant for parameter sets with MLDSA_GAMMA2 = (MLDSA_Q-1)/88
+ * (ML-DSA-44), for which w1 coefficients lie in [0, 43].
+ *
+ * @param[out] r Pointer to output byte array (MLDSA_POLYW1_PACKEDBYTES_88).
+ * @param[in]  a Pointer to input polynomial.
+ */
+MLD_INTERNAL_API
+void mld_polyw1_pack_88(uint8_t r[MLDSA_POLYW1_PACKEDBYTES_88],
+                        const mld_poly *a)
+__contract__(
+  requires(memory_no_alias(r, MLDSA_POLYW1_PACKEDBYTES_88))
+  requires(memory_no_alias(a, sizeof(mld_poly)))
+  requires(array_bound(a->coeffs, 0, MLDSA_N, 0, (MLDSA_Q-1)/(2*MLDSA_GAMMA2_88)))
+  assigns(memory_slice(r, MLDSA_POLYW1_PACKEDBYTES_88))
+);
+#endif /* MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET == 44 \
+        */
+
+#if defined(MLD_CONFIG_MULTILEVEL_WITH_SHARED) || \
+    (MLD_CONFIG_PARAMETER_SET == 65 || MLD_CONFIG_PARAMETER_SET == 87)
+#define mld_polyw1_pack_32 MLD_NAMESPACE(polyw1_pack_32)
+/**
+ * Bit-pack polynomial w1, using 4 bits per coefficient.
+ * This is the variant for parameter sets with MLDSA_GAMMA2 = (MLDSA_Q-1)/32
+ * (ML-DSA-65 and ML-DSA-87), for which w1 coefficients lie in [0, 15].
+ *
+ * @param[out] r Pointer to output byte array (MLDSA_POLYW1_PACKEDBYTES_32).
+ * @param[in]  a Pointer to input polynomial.
+ */
+MLD_INTERNAL_API
+void mld_polyw1_pack_32(uint8_t r[MLDSA_POLYW1_PACKEDBYTES_32],
+                        const mld_poly *a)
+__contract__(
+  requires(memory_no_alias(r, MLDSA_POLYW1_PACKEDBYTES_32))
+  requires(memory_no_alias(a, sizeof(mld_poly)))
+  requires(array_bound(a->coeffs, 0, MLDSA_N, 0, (MLDSA_Q-1)/(2*MLDSA_GAMMA2_32)))
+  assigns(memory_slice(r, MLDSA_POLYW1_PACKEDBYTES_32))
+);
+#endif /* MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLD_CONFIG_PARAMETER_SET == 65 \
+          || MLD_CONFIG_PARAMETER_SET == 87 */
+#endif /* !MLD_CONFIG_NO_SIGN_API || !MLD_CONFIG_NO_VERIFY_API */
+
 #endif /* !MLD_POLY_H */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/poly_kl.c

@@ -601,7 +601,8 @@ void mld_poly_challenge(mld_poly *c, const uint8_t seed[MLDSA_CTILDEBYTES])
     decreases(MLDSA_N - i)
   )
   {
-    /* This loop teminates only probabilistically, hence no decreases clause. */
+    /* This loop terminates only probabilistically, hence no decreases
+     * clause. */
     do
     __loop__(
       assigns(j, object_whole(buf), state, pos)
@@ -618,10 +619,10 @@ void mld_poly_challenge(mld_poly *c, const uint8_t seed[MLDSA_CTILDEBYTES])
 
     c->coeffs[i] = c->coeffs[j];
 
-    /* Reference: Compute coefficent value here in two steps to */
-    /* mixinf unsigned and signed arithmetic with implicit      */
-    /* conversions, and so that CBMC can keep track of ranges   */
-    /* to complete type-safety proof here.                      */
+    /* Reference: Compute coefficient value here in two steps to */
+    /* avoid mixing unsigned and signed arithmetic with implicit */
+    /* conversions, and so that CBMC can keep track of ranges    */
+    /* to complete type-safety proof here.                       */
 
     /* The least-significant bit of signs tells us if we want -1 or +1 */
     offset = 2 * (signs & 1);
@@ -694,6 +695,7 @@ void mld_polyeta_pack(uint8_t r[MLDSA_POLYETA_PACKEDBYTES], const mld_poly *a)
 #endif /* !MLD_CONFIG_NO_KEYPAIR_API */
 
 #if !defined(MLD_CONFIG_NO_KEYPAIR_API) || !defined(MLD_CONFIG_NO_SIGN_API)
+MLD_INTERNAL_API
 void mld_polyeta_unpack(mld_poly *r, const uint8_t a[MLDSA_POLYETA_PACKEDBYTES])
 {
   unsigned int i;
@@ -893,38 +895,6 @@ void mld_polyz_unpack(mld_poly *r, const uint8_t a[MLDSA_POLYZ_PACKEDBYTES])
 
   mld_polyz_unpack_c(r, a);
 }
-
-MLD_INTERNAL_API
-void mld_polyw1_pack(uint8_t r[MLDSA_POLYW1_PACKEDBYTES], const mld_poly *a)
-{
-  unsigned int i;
-
-  mld_assert_bound(a->coeffs, MLDSA_N, 0, (MLDSA_Q - 1) / (2 * MLDSA_GAMMA2));
-
-#if MLD_CONFIG_PARAMETER_SET == 44
-  for (i = 0; i < MLDSA_N / 4; ++i)
-  __loop__(
-    invariant(i <= MLDSA_N/4)
-    decreases(MLDSA_N / 4 - i))
-  {
-    r[3 * i + 0] = (uint8_t)((a->coeffs[4 * i + 0]) & 0xFF);
-    r[3 * i + 0] |= (uint8_t)((a->coeffs[4 * i + 1] << 6) & 0xFF);
-    r[3 * i + 1] = (uint8_t)((a->coeffs[4 * i + 1] >> 2) & 0xFF);
-    r[3 * i + 1] |= (uint8_t)((a->coeffs[4 * i + 2] << 4) & 0xFF);
-    r[3 * i + 2] = (uint8_t)((a->coeffs[4 * i + 2] >> 4) & 0xFF);
-    r[3 * i + 2] |= (uint8_t)((a->coeffs[4 * i + 3] << 2) & 0xFF);
-  }
-#else  /* MLD_CONFIG_PARAMETER_SET == 44 */
-  for (i = 0; i < MLDSA_N / 2; ++i)
-  __loop__(
-    invariant(i <= MLDSA_N/2)
-    decreases(MLDSA_N / 2 - i))
-  {
-    r[i] =
-        (uint8_t)((a->coeffs[2 * i + 0] | (a->coeffs[2 * i + 1] << 4)) & 0xFF);
-  }
-#endif /* MLD_CONFIG_PARAMETER_SET != 44 */
-}
 #endif /* !MLD_CONFIG_NO_SIGN_API || !MLD_CONFIG_NO_VERIFY_API */
 
 /* To facilitate single-compilation-unit (SCU) builds, undefine all macros. */
@@ -937,5 +907,4 @@ void mld_polyw1_pack(uint8_t r[MLDSA_POLYW1_PACKEDBYTES], const mld_poly *a)
 #undef mld_poly_use_hint_c
 #undef mld_polyz_unpack_c
 #undef MLD_POLY_UNIFORM_ETA_NBLOCKS
-#undef MLD_POLY_UNIFORM_ETA_NBLOCKS
 #undef MLD_POLY_UNIFORM_GAMMA1_NBLOCKS

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/poly_kl.h

@@ -2,6 +2,16 @@
  * Copyright (c) The mldsa-native project authors
  * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
  */
+
+/* References
+ * ==========
+ *
+ * - [FIPS204]
+ *   FIPS 204 Module-Lattice-Based Digital Signature Standard
+ *   National Institute of Standards and Technology
+ *   https://csrc.nist.gov/pubs/fips/204/final
+ */
+
 #ifndef MLD_POLY_KL_H
 #define MLD_POLY_KL_H
 
@@ -68,6 +78,9 @@ __contract__(
  * [-MLDSA_ETA, MLDSA_ETA] by performing rejection sampling on the output
  * stream from SHAKE256(seed|nonce_i).
  *
+ * @spec{Implements @[FIPS204, Algorithm 31, RejBoundedPoly] (four-way
+ * batched).}
+ *
  * @param[out] r0     Pointer to first output polynomial.
  * @param[out] r1     Pointer to second output polynomial.
  * @param[out] r2     Pointer to third output polynomial.
@@ -107,6 +120,8 @@ __contract__(
  * [-MLDSA_ETA, MLDSA_ETA] by performing rejection sampling on the output
  * stream from SHAKE256(seed|nonce).
  *
+ * @spec{Implements @[FIPS204, Algorithm 31, RejBoundedPoly].}
+ *
  * @param[out] r     Pointer to output polynomial.
  * @param[in]  seed  Byte array with seed of length MLDSA_CRHBYTES.
  * @param      nonce Nonce.
@@ -133,6 +148,9 @@ __contract__(
  * [-(MLDSA_GAMMA1 - 1), MLDSA_GAMMA1] by unpacking output stream of
  * SHAKE256(seed|nonce).
  *
+ * @spec{Partially implements @[FIPS204, Algorithm 34, ExpandMask] (one
+ * polynomial, i.e. the loop body of lines 3-5).}
+ *
  * @param[out] a     Pointer to output polynomial.
  * @param[in]  seed  Byte array with seed of length MLDSA_CRHBYTES.
  * @param      nonce 16-bit nonce.
@@ -157,6 +175,9 @@ __contract__(
  * [-(MLDSA_GAMMA1 - 1), MLDSA_GAMMA1] by unpacking output streams of
  * SHAKE256(seed|nonce_i).
  *
+ * @spec{Partially implements @[FIPS204, Algorithm 34, ExpandMask] (four-way
+ * batched, i.e. four iterations of the loop body of lines 3-5).}
+ *
  * @param[out] r0     Pointer to first output polynomial.
  * @param[out] r1     Pointer to second output polynomial.
  * @param[out] r2     Pointer to third output polynomial.
@@ -195,8 +216,10 @@ __contract__(
 #if !defined(MLD_CONFIG_NO_SIGN_API) || !defined(MLD_CONFIG_NO_VERIFY_API)
 #define mld_poly_challenge MLD_NAMESPACE_KL(poly_challenge)
 /**
- * Implementation of H. Samples polynomial with MLDSA_TAU nonzero coefficients
- * in {-1, 1} using the output stream of SHAKE256(seed).
+ * Samples polynomial with MLDSA_TAU nonzero coefficients in {-1, 1} using the
+ * output stream of SHAKE256(seed).
+ *
+ * @spec{Implements @[FIPS204, Algorithm 29, SampleInBall].}
  *
  * @param[out] c    Pointer to output polynomial.
  * @param[in]  seed Byte array containing seed of length MLDSA_CTILDEBYTES.
@@ -217,6 +240,8 @@ __contract__(
 /**
  * Bit-pack polynomial with coefficients in [-MLDSA_ETA, MLDSA_ETA].
  *
+ * @spec{Implements @[FIPS204, Algorithm 17, BitPack].}
+ *
  * @param[out] r Pointer to output byte array with at least
  *               MLDSA_POLYETA_PACKEDBYTES bytes.
  * @param[in]  a Pointer to input polynomial.
@@ -252,6 +277,8 @@ __contract__(
 /**
  * Unpack polynomial with coefficients in [-MLDSA_ETA, MLDSA_ETA].
  *
+ * @spec{Implements @[FIPS204, Algorithm 19, BitUnpack].}
+ *
  * @param[out] r Pointer to output polynomial.
  * @param[in]  a Byte array with bit-packed polynomial.
  */
@@ -271,6 +298,8 @@ __contract__(
  * Bit-pack polynomial with coefficients in
  * [-(MLDSA_GAMMA1 - 1), MLDSA_GAMMA1].
  *
+ * @spec{Implements @[FIPS204, Algorithm 17, BitPack].}
+ *
  * @param[out] r Pointer to output byte array with at least
  *               MLDSA_POLYZ_PACKEDBYTES bytes.
  * @param[in]  a Pointer to input polynomial.
@@ -291,6 +320,8 @@ __contract__(
  * Unpack polynomial z with coefficients in
  * [-(MLDSA_GAMMA1 - 1), MLDSA_GAMMA1].
  *
+ * @spec{Implements @[FIPS204, Algorithm 19, BitUnpack].}
+ *
  * @param[out] r Pointer to output polynomial.
  * @param[in]  a Byte array with bit-packed polynomial.
  */
@@ -305,21 +336,32 @@ __contract__(
 
 #define mld_polyw1_pack MLD_NAMESPACE_KL(polyw1_pack)
 /**
- * Bit-pack polynomial w1 with coefficients in [0, 15] or [0, 43]. Input
- * coefficients are assumed to be standard representatives.
+ * Bit-pack polynomial w1. Input coefficients must be in
+ * [0, (MLDSA_Q-1)/(2*MLDSA_GAMMA2)), i.e. [0, 43] for ML-DSA-44 and [0, 15]
+ * for ML-DSA-65/87. Dispatches to the value-specialized variant for the
+ * selected parameter set.
+ *
+ * @spec{Implements @[FIPS204, Algorithm 16, SimpleBitPack].}
  *
  * @param[out] r Pointer to output byte array with at least
  *               MLDSA_POLYW1_PACKEDBYTES bytes.
  * @param[in]  a Pointer to input polynomial.
  */
-MLD_INTERNAL_API
-void mld_polyw1_pack(uint8_t r[MLDSA_POLYW1_PACKEDBYTES], const mld_poly *a)
+static MLD_INLINE void mld_polyw1_pack(uint8_t r[MLDSA_POLYW1_PACKEDBYTES],
+                                       const mld_poly *a)
 __contract__(
   requires(memory_no_alias(r, MLDSA_POLYW1_PACKEDBYTES))
   requires(memory_no_alias(a, sizeof(mld_poly)))
   requires(array_bound(a->coeffs, 0, MLDSA_N, 0, (MLDSA_Q-1)/(2*MLDSA_GAMMA2)))
   assigns(memory_slice(r, MLDSA_POLYW1_PACKEDBYTES))
-);
+)
+{
+#if MLD_CONFIG_PARAMETER_SET == 44
+  mld_polyw1_pack_88(r, a);
+#else
+  mld_polyw1_pack_32(r, a);
+#endif
+}
 #endif /* !MLD_CONFIG_NO_SIGN_API || !MLD_CONFIG_NO_VERIFY_API */
 
 #endif /* !MLD_POLY_KL_H */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/polyvec.c

@@ -30,39 +30,38 @@
 MLD_INTERNAL_API
 void mld_polyvecl_uniform_gamma1(mld_polyvecl *v,
                                  const uint8_t seed[MLDSA_CRHBYTES],
-                                 uint16_t nonce)
+                                 uint16_t kappa)
 {
 #if defined(MLD_CONFIG_SERIAL_FIPS202_ONLY)
   int i;
 #endif
 
-  /* Safety: nonce is at most ((UINT16_MAX - MLDSA_L) / MLDSA_L), and, hence,
-   * this cast is safe. See MLD_NONCE_UB comment in sign.c. */
-  nonce = (uint16_t)(MLDSA_L * nonce);
-  /* Now, nonce <= UINT16_MAX - (MLDSA_L - 1), so the casts below are safe. */
+  /* The caller passes the base counter kappa; component i is sampled from
+   * kappa + i. Safety: kappa <= MLD_MAX_KAPPA and i < MLDSA_L, so the
+   * casts below are safe. See MLD_MAX_KAPPA comment in params.h. */
 #if defined(MLD_CONFIG_SERIAL_FIPS202_ONLY)
   for (i = 0; i < MLDSA_L; i++)
   {
-    mld_poly_uniform_gamma1(&v->vec[i], seed, (uint16_t)(nonce + i));
+    mld_poly_uniform_gamma1(&v->vec[i], seed, (uint16_t)(kappa + i));
   }
 #else /* MLD_CONFIG_SERIAL_FIPS202_ONLY */
 #if MLDSA_L == 4
   mld_poly_uniform_gamma1_4x(&v->vec[0], &v->vec[1], &v->vec[2], &v->vec[3],
-                             seed, nonce, (uint16_t)(nonce + 1),
-                             (uint16_t)(nonce + 2), (uint16_t)(nonce + 3));
+                             seed, kappa, (uint16_t)(kappa + 1),
+                             (uint16_t)(kappa + 2), (uint16_t)(kappa + 3));
 #elif MLDSA_L == 5
   mld_poly_uniform_gamma1_4x(&v->vec[0], &v->vec[1], &v->vec[2], &v->vec[3],
-                             seed, nonce, (uint16_t)(nonce + 1),
-                             (uint16_t)(nonce + 2), (uint16_t)(nonce + 3));
-  mld_poly_uniform_gamma1(&v->vec[4], seed, (uint16_t)(nonce + 4));
+                             seed, kappa, (uint16_t)(kappa + 1),
+                             (uint16_t)(kappa + 2), (uint16_t)(kappa + 3));
+  mld_poly_uniform_gamma1(&v->vec[4], seed, (uint16_t)(kappa + 4));
 #elif MLDSA_L == 7
   mld_poly_uniform_gamma1_4x(&v->vec[0], &v->vec[1], &v->vec[2],
-                             &v->vec[3 /* irrelevant */], seed, nonce,
-                             (uint16_t)(nonce + 1), (uint16_t)(nonce + 2),
+                             &v->vec[3 /* irrelevant */], seed, kappa,
+                             (uint16_t)(kappa + 1), (uint16_t)(kappa + 2),
                              0xFF /* irrelevant */);
   mld_poly_uniform_gamma1_4x(&v->vec[3], &v->vec[4], &v->vec[5], &v->vec[6],
-                             seed, (uint16_t)(nonce + 3), (uint16_t)(nonce + 4),
-                             (uint16_t)(nonce + 5), (uint16_t)(nonce + 6));
+                             seed, (uint16_t)(kappa + 3), (uint16_t)(kappa + 4),
+                             (uint16_t)(kappa + 5), (uint16_t)(kappa + 6));
 #endif /* MLDSA_L == 7 */
 #endif /* !MLD_CONFIG_SERIAL_FIPS202_ONLY */
 
@@ -196,11 +195,11 @@ void mld_polyvecl_pointwise_acc_montgomery(mld_poly *w, const mld_polyvecl *u,
           MLD_USE_NATIVE_POLYVECL_POINTWISE_ACC_MONTGOMERY_L7 &&   \
           MLD_CONFIG_PARAMETER_SET == 87 */
   /* The first input is bounded by [0, MLDSA_Q-1] inclusive.
-   * The second input is bounded by [-(9*MLDSA_Q-1), 9*MLDSA_Q-1] inclusive.
+   * The second input is bounded by [-(MLD_NTT_BOUND-1), MLD_NTT_BOUND-1].
    * Hence, we can safely accumulate in 64-bits without intermediate reductions
    * as MLDSA_L * (MLD_NTT_BOUND-1) * (MLDSA_Q-1) < INT64_MAX.
    *
-   * The worst case is ML-DSA-87: 7 * (9*MLDSA_Q-1) * (MLDSA_Q-1) < 2**52
+   * The worst case is ML-DSA-87: 7 * (MLD_NTT_BOUND-1) * (MLDSA_Q-1) < 2**53
    * (and likewise for negative values).
    */
   mld_polyvecl_pointwise_acc_montgomery_c(w, u, v);