826 lines
28 KiB
C
826 lines
28 KiB
C
/* kyber-kdep.c - the Kyber key encapsulation mechanism (KYBER_K dependent part)
|
|
* Copyright (C) 2024 g10 Code GmbH
|
|
*
|
|
* This file was modified for use by Libgcrypt.
|
|
*
|
|
* This file is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU Lesser General Public License as
|
|
* published by the Free Software Foundation; either version 2.1 of
|
|
* the License, or (at your option) any later version.
|
|
*
|
|
* This file is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this program; if not, see <https://www.gnu.org/licenses/>.
|
|
* SPDX-License-Identifier: LGPL-2.1-or-later
|
|
*
|
|
* You can also use this file under the same licence of original code.
|
|
* SPDX-License-Identifier: CC0 OR Apache-2.0
|
|
*
|
|
*/
|
|
/*
|
|
Original code from:
|
|
|
|
Repository: https://github.com/pq-crystals/kyber.git
|
|
Branch: standard
|
|
Commit: 11d00ff1f20cfca1f72d819e5a45165c1e0a2816
|
|
|
|
Licence:
|
|
Public Domain (https://creativecommons.org/share-your-work/public-domain/cc0/);
|
|
or Apache 2.0 License (https://www.apache.org/licenses/LICENSE-2.0.html).
|
|
|
|
Authors:
|
|
Joppe Bos
|
|
Léo Ducas
|
|
Eike Kiltz
|
|
Tancrède Lepoint
|
|
Vadim Lyubashevsky
|
|
John Schanck
|
|
Peter Schwabe
|
|
Gregor Seiler
|
|
Damien Stehlé
|
|
|
|
Kyber Home: https://www.pq-crystals.org/kyber/
|
|
*/
|
|
/*
|
|
* From original code, following modification was made.
|
|
*
|
|
* - C++ style comments are changed to C-style.
|
|
*
|
|
* - With the change of "verify" routine (now "verify1"), no negation
|
|
* for the cmov argument in crypto_kem_dec.
|
|
*
|
|
* - Call to xof_init and xof_close are added in gen_matrix.
|
|
*/
|
|
|
|
/*************** kyber/ref/polyvec.h */
|
|
typedef struct{
|
|
poly vec[KYBER_K];
|
|
} polyvec;
|
|
|
|
static void polyvec_compress(uint8_t r[KYBER_POLYVECCOMPRESSEDBYTES], const polyvec *a);
|
|
static void polyvec_decompress(polyvec *r, const uint8_t a[KYBER_POLYVECCOMPRESSEDBYTES]);
|
|
|
|
static void polyvec_tobytes(uint8_t r[KYBER_POLYVECBYTES], const polyvec *a);
|
|
static void polyvec_frombytes(polyvec *r, const uint8_t a[KYBER_POLYVECBYTES]);
|
|
|
|
static void polyvec_ntt(polyvec *r);
|
|
static void polyvec_invntt_tomont(polyvec *r);
|
|
|
|
static void polyvec_basemul_acc_montgomery(poly *r, const polyvec *a, const polyvec *b);
|
|
|
|
static void polyvec_reduce(polyvec *r);
|
|
|
|
static void polyvec_add(polyvec *r, const polyvec *a, const polyvec *b);
|
|
|
|
/*************** kyber/ref/indcpa.h */
|
|
static void gen_matrix(polyvec *a, const uint8_t seed[KYBER_SYMBYTES], int transposed);
|
|
|
|
static void indcpa_keypair_derand(uint8_t pk[KYBER_INDCPA_PUBLICKEYBYTES],
|
|
uint8_t sk[KYBER_INDCPA_SECRETKEYBYTES],
|
|
const uint8_t coins[KYBER_SYMBYTES]);
|
|
|
|
static void indcpa_enc(uint8_t c[KYBER_INDCPA_BYTES],
|
|
const uint8_t m[KYBER_INDCPA_MSGBYTES],
|
|
const uint8_t pk[KYBER_INDCPA_PUBLICKEYBYTES],
|
|
const uint8_t coins[KYBER_SYMBYTES]);
|
|
|
|
static void indcpa_dec(uint8_t m[KYBER_INDCPA_MSGBYTES],
|
|
const uint8_t c[KYBER_INDCPA_BYTES],
|
|
const uint8_t sk[KYBER_INDCPA_SECRETKEYBYTES]);
|
|
|
|
/*************** kyber/ref/kem.h */
|
|
|
|
static int crypto_kem_keypair_derand(uint8_t *pk, uint8_t *sk, const uint8_t *coins);
|
|
|
|
static int crypto_kem_enc_derand(uint8_t *ct, uint8_t *ss, const uint8_t *pk, const uint8_t *coins);
|
|
|
|
/*************** kyber/ref/indcpa.c */
|
|
|
|
/*************************************************
|
|
* Name: pack_pk
|
|
*
|
|
* Description: Serialize the public key as concatenation of the
|
|
* serialized vector of polynomials pk
|
|
* and the public seed used to generate the matrix A.
|
|
*
|
|
* Arguments: uint8_t *r: pointer to the output serialized public key
|
|
* polyvec *pk: pointer to the input public-key polyvec
|
|
* const uint8_t *seed: pointer to the input public seed
|
|
**************************************************/
|
|
static void pack_pk(uint8_t r[KYBER_INDCPA_PUBLICKEYBYTES],
|
|
polyvec *pk,
|
|
const uint8_t seed[KYBER_SYMBYTES])
|
|
{
|
|
polyvec_tobytes(r, pk);
|
|
memcpy(r+KYBER_POLYVECBYTES, seed, KYBER_SYMBYTES);
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: unpack_pk
|
|
*
|
|
* Description: De-serialize public key from a byte array;
|
|
* approximate inverse of pack_pk
|
|
*
|
|
* Arguments: - polyvec *pk: pointer to output public-key polynomial vector
|
|
* - uint8_t *seed: pointer to output seed to generate matrix A
|
|
* - const uint8_t *packedpk: pointer to input serialized public key
|
|
**************************************************/
|
|
static void unpack_pk(polyvec *pk,
|
|
uint8_t seed[KYBER_SYMBYTES],
|
|
const uint8_t packedpk[KYBER_INDCPA_PUBLICKEYBYTES])
|
|
{
|
|
polyvec_frombytes(pk, packedpk);
|
|
memcpy(seed, packedpk+KYBER_POLYVECBYTES, KYBER_SYMBYTES);
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: pack_sk
|
|
*
|
|
* Description: Serialize the secret key
|
|
*
|
|
* Arguments: - uint8_t *r: pointer to output serialized secret key
|
|
* - polyvec *sk: pointer to input vector of polynomials (secret key)
|
|
**************************************************/
|
|
static void pack_sk(uint8_t r[KYBER_INDCPA_SECRETKEYBYTES], polyvec *sk)
|
|
{
|
|
polyvec_tobytes(r, sk);
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: unpack_sk
|
|
*
|
|
* Description: De-serialize the secret key; inverse of pack_sk
|
|
*
|
|
* Arguments: - polyvec *sk: pointer to output vector of polynomials (secret key)
|
|
* - const uint8_t *packedsk: pointer to input serialized secret key
|
|
**************************************************/
|
|
static void unpack_sk(polyvec *sk, const uint8_t packedsk[KYBER_INDCPA_SECRETKEYBYTES])
|
|
{
|
|
polyvec_frombytes(sk, packedsk);
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: pack_ciphertext
|
|
*
|
|
* Description: Serialize the ciphertext as concatenation of the
|
|
* compressed and serialized vector of polynomials b
|
|
* and the compressed and serialized polynomial v
|
|
*
|
|
* Arguments: uint8_t *r: pointer to the output serialized ciphertext
|
|
* poly *pk: pointer to the input vector of polynomials b
|
|
* poly *v: pointer to the input polynomial v
|
|
**************************************************/
|
|
static void pack_ciphertext(uint8_t r[KYBER_INDCPA_BYTES], polyvec *b, poly *v)
|
|
{
|
|
polyvec_compress(r, b);
|
|
poly_compress(r+KYBER_POLYVECCOMPRESSEDBYTES, v);
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: unpack_ciphertext
|
|
*
|
|
* Description: De-serialize and decompress ciphertext from a byte array;
|
|
* approximate inverse of pack_ciphertext
|
|
*
|
|
* Arguments: - polyvec *b: pointer to the output vector of polynomials b
|
|
* - poly *v: pointer to the output polynomial v
|
|
* - const uint8_t *c: pointer to the input serialized ciphertext
|
|
**************************************************/
|
|
static void unpack_ciphertext(polyvec *b, poly *v, const uint8_t c[KYBER_INDCPA_BYTES])
|
|
{
|
|
polyvec_decompress(b, c);
|
|
poly_decompress(v, c+KYBER_POLYVECCOMPRESSEDBYTES);
|
|
}
|
|
|
|
#define gen_a(A,B) gen_matrix(A,B,0)
|
|
#define gen_at(A,B) gen_matrix(A,B,1)
|
|
|
|
/*************************************************
|
|
* Name: gen_matrix
|
|
*
|
|
* Description: Deterministically generate matrix A (or the transpose of A)
|
|
* from a seed. Entries of the matrix are polynomials that look
|
|
* uniformly random. Performs rejection sampling on output of
|
|
* a XOF
|
|
*
|
|
* Arguments: - polyvec *a: pointer to ouptput matrix A
|
|
* - const uint8_t *seed: pointer to input seed
|
|
* - int transposed: boolean deciding whether A or A^T is generated
|
|
**************************************************/
|
|
#define GEN_MATRIX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES)
|
|
void gen_matrix(polyvec *a, const uint8_t seed[KYBER_SYMBYTES], int transposed)
|
|
{
|
|
unsigned int ctr, i, j, k;
|
|
unsigned int buflen, off;
|
|
uint8_t buf[GEN_MATRIX_NBLOCKS*XOF_BLOCKBYTES+2];
|
|
xof_state state;
|
|
|
|
for(i=0;i<KYBER_K;i++) {
|
|
for(j=0;j<KYBER_K;j++) {
|
|
xof_init(&state);
|
|
if(transposed)
|
|
xof_absorb(&state, seed, i, j);
|
|
else
|
|
xof_absorb(&state, seed, j, i);
|
|
|
|
xof_squeezeblocks(buf, GEN_MATRIX_NBLOCKS, &state);
|
|
buflen = GEN_MATRIX_NBLOCKS*XOF_BLOCKBYTES;
|
|
ctr = rej_uniform(a[i].vec[j].coeffs, KYBER_N, buf, buflen);
|
|
|
|
while(ctr < KYBER_N) {
|
|
off = buflen % 3;
|
|
for(k = 0; k < off; k++)
|
|
buf[k] = buf[buflen - off + k];
|
|
xof_squeezeblocks(buf + off, 1, &state);
|
|
buflen = off + XOF_BLOCKBYTES;
|
|
ctr += rej_uniform(a[i].vec[j].coeffs + ctr, KYBER_N - ctr, buf, buflen);
|
|
}
|
|
xof_close (&state);
|
|
}
|
|
}
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: indcpa_keypair_derand
|
|
*
|
|
* Description: Generates public and private key for the CPA-secure
|
|
* public-key encryption scheme underlying Kyber
|
|
*
|
|
* Arguments: - uint8_t *pk: pointer to output public key
|
|
* (of length KYBER_INDCPA_PUBLICKEYBYTES bytes)
|
|
* - uint8_t *sk: pointer to output private key
|
|
* (of length KYBER_INDCPA_SECRETKEYBYTES bytes)
|
|
* - const uint8_t *coins: pointer to input randomness
|
|
* (of length KYBER_SYMBYTES bytes)
|
|
**************************************************/
|
|
void indcpa_keypair_derand(uint8_t pk[KYBER_INDCPA_PUBLICKEYBYTES],
|
|
uint8_t sk[KYBER_INDCPA_SECRETKEYBYTES],
|
|
const uint8_t coins[KYBER_SYMBYTES])
|
|
{
|
|
unsigned int i;
|
|
uint8_t buf[2*KYBER_SYMBYTES];
|
|
const uint8_t *publicseed = buf;
|
|
const uint8_t *noiseseed = buf+KYBER_SYMBYTES;
|
|
uint8_t nonce = 0;
|
|
polyvec a[KYBER_K], e, pkpv, skpv;
|
|
|
|
hash_g(buf, coins, KYBER_SYMBYTES);
|
|
|
|
gen_a(a, publicseed);
|
|
|
|
for(i=0;i<KYBER_K;i++)
|
|
poly_getnoise_eta1(&skpv.vec[i], noiseseed, nonce++);
|
|
for(i=0;i<KYBER_K;i++)
|
|
poly_getnoise_eta1(&e.vec[i], noiseseed, nonce++);
|
|
|
|
polyvec_ntt(&skpv);
|
|
polyvec_ntt(&e);
|
|
|
|
/* matrix-vector multiplication */
|
|
for(i=0;i<KYBER_K;i++) {
|
|
polyvec_basemul_acc_montgomery(&pkpv.vec[i], &a[i], &skpv);
|
|
poly_tomont(&pkpv.vec[i]);
|
|
}
|
|
|
|
polyvec_add(&pkpv, &pkpv, &e);
|
|
polyvec_reduce(&pkpv);
|
|
|
|
pack_sk(sk, &skpv);
|
|
pack_pk(pk, &pkpv, publicseed);
|
|
}
|
|
|
|
|
|
/*************************************************
|
|
* Name: indcpa_enc
|
|
*
|
|
* Description: Encryption function of the CPA-secure
|
|
* public-key encryption scheme underlying Kyber.
|
|
*
|
|
* Arguments: - uint8_t *c: pointer to output ciphertext
|
|
* (of length KYBER_INDCPA_BYTES bytes)
|
|
* - const uint8_t *m: pointer to input message
|
|
* (of length KYBER_INDCPA_MSGBYTES bytes)
|
|
* - const uint8_t *pk: pointer to input public key
|
|
* (of length KYBER_INDCPA_PUBLICKEYBYTES)
|
|
* - const uint8_t *coins: pointer to input random coins used as seed
|
|
* (of length KYBER_SYMBYTES) to deterministically
|
|
* generate all randomness
|
|
**************************************************/
|
|
void indcpa_enc(uint8_t c[KYBER_INDCPA_BYTES],
|
|
const uint8_t m[KYBER_INDCPA_MSGBYTES],
|
|
const uint8_t pk[KYBER_INDCPA_PUBLICKEYBYTES],
|
|
const uint8_t coins[KYBER_SYMBYTES])
|
|
{
|
|
unsigned int i;
|
|
uint8_t seed[KYBER_SYMBYTES];
|
|
uint8_t nonce = 0;
|
|
polyvec sp, pkpv, ep, at[KYBER_K], b;
|
|
poly v, k, epp;
|
|
|
|
unpack_pk(&pkpv, seed, pk);
|
|
poly_frommsg(&k, m);
|
|
gen_at(at, seed);
|
|
|
|
for(i=0;i<KYBER_K;i++)
|
|
poly_getnoise_eta1(sp.vec+i, coins, nonce++);
|
|
for(i=0;i<KYBER_K;i++)
|
|
poly_getnoise_eta2(ep.vec+i, coins, nonce++);
|
|
poly_getnoise_eta2(&epp, coins, nonce++);
|
|
|
|
polyvec_ntt(&sp);
|
|
|
|
/* matrix-vector multiplication */
|
|
for(i=0;i<KYBER_K;i++)
|
|
polyvec_basemul_acc_montgomery(&b.vec[i], &at[i], &sp);
|
|
|
|
polyvec_basemul_acc_montgomery(&v, &pkpv, &sp);
|
|
|
|
polyvec_invntt_tomont(&b);
|
|
poly_invntt_tomont(&v);
|
|
|
|
polyvec_add(&b, &b, &ep);
|
|
poly_add(&v, &v, &epp);
|
|
poly_add(&v, &v, &k);
|
|
polyvec_reduce(&b);
|
|
poly_reduce(&v);
|
|
|
|
pack_ciphertext(c, &b, &v);
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: indcpa_dec
|
|
*
|
|
* Description: Decryption function of the CPA-secure
|
|
* public-key encryption scheme underlying Kyber.
|
|
*
|
|
* Arguments: - uint8_t *m: pointer to output decrypted message
|
|
* (of length KYBER_INDCPA_MSGBYTES)
|
|
* - const uint8_t *c: pointer to input ciphertext
|
|
* (of length KYBER_INDCPA_BYTES)
|
|
* - const uint8_t *sk: pointer to input secret key
|
|
* (of length KYBER_INDCPA_SECRETKEYBYTES)
|
|
**************************************************/
|
|
void indcpa_dec(uint8_t m[KYBER_INDCPA_MSGBYTES],
|
|
const uint8_t c[KYBER_INDCPA_BYTES],
|
|
const uint8_t sk[KYBER_INDCPA_SECRETKEYBYTES])
|
|
{
|
|
polyvec b, skpv;
|
|
poly v, mp;
|
|
|
|
unpack_ciphertext(&b, &v, c);
|
|
unpack_sk(&skpv, sk);
|
|
|
|
polyvec_ntt(&b);
|
|
polyvec_basemul_acc_montgomery(&mp, &skpv, &b);
|
|
poly_invntt_tomont(&mp);
|
|
|
|
poly_sub(&mp, &v, &mp);
|
|
poly_reduce(&mp);
|
|
|
|
poly_tomsg(m, &mp);
|
|
}
|
|
|
|
/*************** kyber/ref/kem.c */
|
|
/*************************************************
|
|
* Name: crypto_kem_keypair_derand
|
|
*
|
|
* Description: Generates public and private key
|
|
* for CCA-secure Kyber key encapsulation mechanism
|
|
*
|
|
* Arguments: - uint8_t *pk: pointer to output public key
|
|
* (an already allocated array of KYBER_PUBLICKEYBYTES bytes)
|
|
* - uint8_t *sk: pointer to output private key
|
|
* (an already allocated array of KYBER_SECRETKEYBYTES bytes)
|
|
* - uint8_t *coins: pointer to input randomness
|
|
* (an already allocated array filled with 2*KYBER_SYMBYTES random bytes)
|
|
**
|
|
* Returns 0 (success)
|
|
**************************************************/
|
|
int crypto_kem_keypair_derand(uint8_t *pk,
|
|
uint8_t *sk,
|
|
const uint8_t *coins)
|
|
{
|
|
indcpa_keypair_derand(pk, sk, coins);
|
|
memcpy(sk+KYBER_INDCPA_SECRETKEYBYTES, pk, KYBER_PUBLICKEYBYTES);
|
|
hash_h(sk+KYBER_SECRETKEYBYTES-2*KYBER_SYMBYTES, pk, KYBER_PUBLICKEYBYTES);
|
|
/* Value z for pseudo-random output on reject */
|
|
memcpy(sk+KYBER_SECRETKEYBYTES-KYBER_SYMBYTES, coins+KYBER_SYMBYTES, KYBER_SYMBYTES);
|
|
return 0;
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: crypto_kem_keypair
|
|
*
|
|
* Description: Generates public and private key
|
|
* for CCA-secure Kyber key encapsulation mechanism
|
|
*
|
|
* Arguments: - uint8_t *pk: pointer to output public key
|
|
* (an already allocated array of KYBER_PUBLICKEYBYTES bytes)
|
|
* - uint8_t *sk: pointer to output private key
|
|
* (an already allocated array of KYBER_SECRETKEYBYTES bytes)
|
|
*
|
|
* Returns 0 (success)
|
|
**************************************************/
|
|
int crypto_kem_keypair(uint8_t *pk,
|
|
uint8_t *sk)
|
|
{
|
|
uint8_t coins[2*KYBER_SYMBYTES];
|
|
randombytes(coins, 2*KYBER_SYMBYTES);
|
|
crypto_kem_keypair_derand(pk, sk, coins);
|
|
return 0;
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: crypto_kem_enc_derand
|
|
*
|
|
* Description: Generates cipher text and shared
|
|
* secret for given public key
|
|
*
|
|
* Arguments: - uint8_t *ct: pointer to output cipher text
|
|
* (an already allocated array of KYBER_CIPHERTEXTBYTES bytes)
|
|
* - uint8_t *ss: pointer to output shared secret
|
|
* (an already allocated array of KYBER_SSBYTES bytes)
|
|
* - const uint8_t *pk: pointer to input public key
|
|
* (an already allocated array of KYBER_PUBLICKEYBYTES bytes)
|
|
* - const uint8_t *coins: pointer to input randomness
|
|
* (an already allocated array filled with KYBER_SYMBYTES random bytes)
|
|
**
|
|
* Returns 0 (success)
|
|
**************************************************/
|
|
int crypto_kem_enc_derand(uint8_t *ct,
|
|
uint8_t *ss,
|
|
const uint8_t *pk,
|
|
const uint8_t *coins)
|
|
{
|
|
uint8_t buf[2*KYBER_SYMBYTES];
|
|
/* Will contain key, coins */
|
|
uint8_t kr[2*KYBER_SYMBYTES];
|
|
|
|
memcpy(buf, coins, KYBER_SYMBYTES);
|
|
|
|
/* Multitarget countermeasure for coins + contributory KEM */
|
|
hash_h(buf+KYBER_SYMBYTES, pk, KYBER_PUBLICKEYBYTES);
|
|
hash_g(kr, buf, 2*KYBER_SYMBYTES);
|
|
|
|
/* coins are in kr+KYBER_SYMBYTES */
|
|
indcpa_enc(ct, buf, pk, kr+KYBER_SYMBYTES);
|
|
|
|
memcpy(ss,kr,KYBER_SYMBYTES);
|
|
return 0;
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: crypto_kem_enc
|
|
*
|
|
* Description: Generates cipher text and shared
|
|
* secret for given public key
|
|
*
|
|
* Arguments: - uint8_t *ct: pointer to output cipher text
|
|
* (an already allocated array of KYBER_CIPHERTEXTBYTES bytes)
|
|
* - uint8_t *ss: pointer to output shared secret
|
|
* (an already allocated array of KYBER_SSBYTES bytes)
|
|
* - const uint8_t *pk: pointer to input public key
|
|
* (an already allocated array of KYBER_PUBLICKEYBYTES bytes)
|
|
*
|
|
* Returns 0 (success)
|
|
**************************************************/
|
|
int crypto_kem_enc(uint8_t *ct,
|
|
uint8_t *ss,
|
|
const uint8_t *pk)
|
|
{
|
|
uint8_t coins[KYBER_SYMBYTES];
|
|
randombytes(coins, KYBER_SYMBYTES);
|
|
crypto_kem_enc_derand(ct, ss, pk, coins);
|
|
return 0;
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: crypto_kem_dec
|
|
*
|
|
* Description: Generates shared secret for given
|
|
* cipher text and private key
|
|
*
|
|
* Arguments: - uint8_t *ss: pointer to output shared secret
|
|
* (an already allocated array of KYBER_SSBYTES bytes)
|
|
* - const uint8_t *ct: pointer to input cipher text
|
|
* (an already allocated array of KYBER_CIPHERTEXTBYTES bytes)
|
|
* - const uint8_t *sk: pointer to input private key
|
|
* (an already allocated array of KYBER_SECRETKEYBYTES bytes)
|
|
*
|
|
* Returns 0.
|
|
*
|
|
* On failure, ss will contain a pseudo-random value.
|
|
**************************************************/
|
|
int crypto_kem_dec(uint8_t *ss,
|
|
const uint8_t *ct,
|
|
const uint8_t *sk)
|
|
{
|
|
unsigned int success;
|
|
uint8_t buf[2*KYBER_SYMBYTES];
|
|
/* Will contain key, coins */
|
|
uint8_t kr[2*KYBER_SYMBYTES];
|
|
uint8_t cmp[KYBER_CIPHERTEXTBYTES+KYBER_SYMBYTES];
|
|
const uint8_t *pk = sk+KYBER_INDCPA_SECRETKEYBYTES;
|
|
|
|
indcpa_dec(buf, ct, sk);
|
|
|
|
/* Multitarget countermeasure for coins + contributory KEM */
|
|
memcpy(buf+KYBER_SYMBYTES, sk+KYBER_SECRETKEYBYTES-2*KYBER_SYMBYTES, KYBER_SYMBYTES);
|
|
hash_g(kr, buf, 2*KYBER_SYMBYTES);
|
|
|
|
/* coins are in kr+KYBER_SYMBYTES */
|
|
indcpa_enc(cmp, buf, pk, kr+KYBER_SYMBYTES);
|
|
|
|
success = verify1(ct, cmp, KYBER_CIPHERTEXTBYTES);
|
|
|
|
/* Compute rejection key */
|
|
rkprf(ss,sk+KYBER_SECRETKEYBYTES-KYBER_SYMBYTES,ct);
|
|
|
|
/* Copy true key to return buffer if fail is false */
|
|
cmov(ss,kr,KYBER_SYMBYTES,success);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/*************** kyber/ref/polyvec.c */
|
|
|
|
/*************************************************
|
|
* Name: polyvec_compress
|
|
*
|
|
* Description: Compress and serialize vector of polynomials
|
|
*
|
|
* Arguments: - uint8_t *r: pointer to output byte array
|
|
* (needs space for KYBER_POLYVECCOMPRESSEDBYTES)
|
|
* - const polyvec *a: pointer to input vector of polynomials
|
|
**************************************************/
|
|
void polyvec_compress(uint8_t r[KYBER_POLYVECCOMPRESSEDBYTES], const polyvec *a)
|
|
{
|
|
unsigned int i,j,k;
|
|
uint64_t d0;
|
|
|
|
#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352))
|
|
uint16_t t[8];
|
|
for(i=0;i<KYBER_K;i++) {
|
|
for(j=0;j<KYBER_N/8;j++) {
|
|
for(k=0;k<8;k++) {
|
|
t[k] = a->vec[i].coeffs[8*j+k];
|
|
t[k] += ((int16_t)t[k] >> 15) & KYBER_Q;
|
|
/* t[k] = ((((uint32_t)t[k] << 11) + KYBER_Q/2)/KYBER_Q) & 0x7ff; */
|
|
d0 = t[k];
|
|
d0 <<= 11;
|
|
d0 += 1664;
|
|
d0 *= 645084;
|
|
d0 >>= 31;
|
|
t[k] = d0 & 0x7ff;
|
|
|
|
}
|
|
|
|
r[ 0] = (t[0] >> 0);
|
|
r[ 1] = (t[0] >> 8) | (t[1] << 3);
|
|
r[ 2] = (t[1] >> 5) | (t[2] << 6);
|
|
r[ 3] = (t[2] >> 2);
|
|
r[ 4] = (t[2] >> 10) | (t[3] << 1);
|
|
r[ 5] = (t[3] >> 7) | (t[4] << 4);
|
|
r[ 6] = (t[4] >> 4) | (t[5] << 7);
|
|
r[ 7] = (t[5] >> 1);
|
|
r[ 8] = (t[5] >> 9) | (t[6] << 2);
|
|
r[ 9] = (t[6] >> 6) | (t[7] << 5);
|
|
r[10] = (t[7] >> 3);
|
|
r += 11;
|
|
}
|
|
}
|
|
#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320))
|
|
uint16_t t[4];
|
|
for(i=0;i<KYBER_K;i++) {
|
|
for(j=0;j<KYBER_N/4;j++) {
|
|
for(k=0;k<4;k++) {
|
|
t[k] = a->vec[i].coeffs[4*j+k];
|
|
t[k] += ((int16_t)t[k] >> 15) & KYBER_Q;
|
|
/* t[k] = ((((uint32_t)t[k] << 10) + KYBER_Q/2)/ KYBER_Q) & 0x3ff; */
|
|
d0 = t[k];
|
|
d0 <<= 10;
|
|
d0 += 1665;
|
|
d0 *= 1290167;
|
|
d0 >>= 32;
|
|
t[k] = d0 & 0x3ff;
|
|
}
|
|
|
|
r[0] = (t[0] >> 0);
|
|
r[1] = (t[0] >> 8) | (t[1] << 2);
|
|
r[2] = (t[1] >> 6) | (t[2] << 4);
|
|
r[3] = (t[2] >> 4) | (t[3] << 6);
|
|
r[4] = (t[3] >> 2);
|
|
r += 5;
|
|
}
|
|
}
|
|
#else
|
|
#error "KYBER_POLYVECCOMPRESSEDBYTES needs to be in {320*KYBER_K, 352*KYBER_K}"
|
|
#endif
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: polyvec_decompress
|
|
*
|
|
* Description: De-serialize and decompress vector of polynomials;
|
|
* approximate inverse of polyvec_compress
|
|
*
|
|
* Arguments: - polyvec *r: pointer to output vector of polynomials
|
|
* - const uint8_t *a: pointer to input byte array
|
|
* (of length KYBER_POLYVECCOMPRESSEDBYTES)
|
|
**************************************************/
|
|
void polyvec_decompress(polyvec *r, const uint8_t a[KYBER_POLYVECCOMPRESSEDBYTES])
|
|
{
|
|
unsigned int i,j,k;
|
|
|
|
#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352))
|
|
uint16_t t[8];
|
|
for(i=0;i<KYBER_K;i++) {
|
|
for(j=0;j<KYBER_N/8;j++) {
|
|
t[0] = (a[0] >> 0) | ((uint16_t)a[ 1] << 8);
|
|
t[1] = (a[1] >> 3) | ((uint16_t)a[ 2] << 5);
|
|
t[2] = (a[2] >> 6) | ((uint16_t)a[ 3] << 2) | ((uint16_t)a[4] << 10);
|
|
t[3] = (a[4] >> 1) | ((uint16_t)a[ 5] << 7);
|
|
t[4] = (a[5] >> 4) | ((uint16_t)a[ 6] << 4);
|
|
t[5] = (a[6] >> 7) | ((uint16_t)a[ 7] << 1) | ((uint16_t)a[8] << 9);
|
|
t[6] = (a[8] >> 2) | ((uint16_t)a[ 9] << 6);
|
|
t[7] = (a[9] >> 5) | ((uint16_t)a[10] << 3);
|
|
a += 11;
|
|
|
|
for(k=0;k<8;k++)
|
|
r->vec[i].coeffs[8*j+k] = ((uint32_t)(t[k] & 0x7FF)*KYBER_Q + 1024) >> 11;
|
|
}
|
|
}
|
|
#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320))
|
|
uint16_t t[4];
|
|
for(i=0;i<KYBER_K;i++) {
|
|
for(j=0;j<KYBER_N/4;j++) {
|
|
t[0] = (a[0] >> 0) | ((uint16_t)a[1] << 8);
|
|
t[1] = (a[1] >> 2) | ((uint16_t)a[2] << 6);
|
|
t[2] = (a[2] >> 4) | ((uint16_t)a[3] << 4);
|
|
t[3] = (a[3] >> 6) | ((uint16_t)a[4] << 2);
|
|
a += 5;
|
|
|
|
for(k=0;k<4;k++)
|
|
r->vec[i].coeffs[4*j+k] = ((uint32_t)(t[k] & 0x3FF)*KYBER_Q + 512) >> 10;
|
|
}
|
|
}
|
|
#else
|
|
#error "KYBER_POLYVECCOMPRESSEDBYTES needs to be in {320*KYBER_K, 352*KYBER_K}"
|
|
#endif
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: polyvec_tobytes
|
|
*
|
|
* Description: Serialize vector of polynomials
|
|
*
|
|
* Arguments: - uint8_t *r: pointer to output byte array
|
|
* (needs space for KYBER_POLYVECBYTES)
|
|
* - const polyvec *a: pointer to input vector of polynomials
|
|
**************************************************/
|
|
void polyvec_tobytes(uint8_t r[KYBER_POLYVECBYTES], const polyvec *a)
|
|
{
|
|
unsigned int i;
|
|
for(i=0;i<KYBER_K;i++)
|
|
poly_tobytes(r+i*KYBER_POLYBYTES, &a->vec[i]);
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: polyvec_frombytes
|
|
*
|
|
* Description: De-serialize vector of polynomials;
|
|
* inverse of polyvec_tobytes
|
|
*
|
|
* Arguments: - uint8_t *r: pointer to output byte array
|
|
* - const polyvec *a: pointer to input vector of polynomials
|
|
* (of length KYBER_POLYVECBYTES)
|
|
**************************************************/
|
|
void polyvec_frombytes(polyvec *r, const uint8_t a[KYBER_POLYVECBYTES])
|
|
{
|
|
unsigned int i;
|
|
for(i=0;i<KYBER_K;i++)
|
|
poly_frombytes(&r->vec[i], a+i*KYBER_POLYBYTES);
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: polyvec_ntt
|
|
*
|
|
* Description: Apply forward NTT to all elements of a vector of polynomials
|
|
*
|
|
* Arguments: - polyvec *r: pointer to in/output vector of polynomials
|
|
**************************************************/
|
|
void polyvec_ntt(polyvec *r)
|
|
{
|
|
unsigned int i;
|
|
for(i=0;i<KYBER_K;i++)
|
|
poly_ntt(&r->vec[i]);
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: polyvec_invntt_tomont
|
|
*
|
|
* Description: Apply inverse NTT to all elements of a vector of polynomials
|
|
* and multiply by Montgomery factor 2^16
|
|
*
|
|
* Arguments: - polyvec *r: pointer to in/output vector of polynomials
|
|
**************************************************/
|
|
void polyvec_invntt_tomont(polyvec *r)
|
|
{
|
|
unsigned int i;
|
|
for(i=0;i<KYBER_K;i++)
|
|
poly_invntt_tomont(&r->vec[i]);
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: polyvec_basemul_acc_montgomery
|
|
*
|
|
* Description: Multiply elements of a and b in NTT domain, accumulate into r,
|
|
* and multiply by 2^-16.
|
|
*
|
|
* Arguments: - poly *r: pointer to output polynomial
|
|
* - const polyvec *a: pointer to first input vector of polynomials
|
|
* - const polyvec *b: pointer to second input vector of polynomials
|
|
**************************************************/
|
|
void polyvec_basemul_acc_montgomery(poly *r, const polyvec *a, const polyvec *b)
|
|
{
|
|
unsigned int i;
|
|
poly t;
|
|
|
|
poly_basemul_montgomery(r, &a->vec[0], &b->vec[0]);
|
|
for(i=1;i<KYBER_K;i++) {
|
|
poly_basemul_montgomery(&t, &a->vec[i], &b->vec[i]);
|
|
poly_add(r, r, &t);
|
|
}
|
|
|
|
poly_reduce(r);
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: polyvec_reduce
|
|
*
|
|
* Description: Applies Barrett reduction to each coefficient
|
|
* of each element of a vector of polynomials;
|
|
* for details of the Barrett reduction see comments in reduce.c
|
|
*
|
|
* Arguments: - polyvec *r: pointer to input/output polynomial
|
|
**************************************************/
|
|
void polyvec_reduce(polyvec *r)
|
|
{
|
|
unsigned int i;
|
|
for(i=0;i<KYBER_K;i++)
|
|
poly_reduce(&r->vec[i]);
|
|
}
|
|
|
|
/*************************************************
|
|
* Name: polyvec_add
|
|
*
|
|
* Description: Add vectors of polynomials
|
|
*
|
|
* Arguments: - polyvec *r: pointer to output vector of polynomials
|
|
* - const polyvec *a: pointer to first input vector of polynomials
|
|
* - const polyvec *b: pointer to second input vector of polynomials
|
|
**************************************************/
|
|
void polyvec_add(polyvec *r, const polyvec *a, const polyvec *b)
|
|
{
|
|
unsigned int i;
|
|
for(i=0;i<KYBER_K;i++)
|
|
poly_add(&r->vec[i], &a->vec[i], &b->vec[i]);
|
|
}
|
|
|
|
/*****************/
|
|
#undef KYBER_K
|
|
#undef KYBER_POLYCOMPRESSEDBYTES
|
|
#undef KYBER_POLYVECCOMPRESSEDBYTES
|
|
#undef poly_compress
|
|
#undef poly_decompress
|
|
#undef poly_getnoise_eta1
|
|
#undef crypto_kem_keypair_derand
|
|
#undef crypto_kem_enc_derand
|
|
#undef crypto_kem_keypair
|
|
#undef crypto_kem_enc
|
|
#undef crypto_kem_dec
|
|
#undef polyvec
|
|
#undef polyvec_compress
|
|
#undef polyvec_decompress
|
|
#undef polyvec_tobytes
|
|
#undef polyvec_frombytes
|
|
#undef polyvec_ntt
|
|
#undef polyvec_invntt_tomont
|
|
#undef polyvec_basemul_acc_montgomery
|
|
#undef polyvec_reduce
|
|
#undef polyvec_add
|
|
#undef pack_pk
|
|
#undef unpack_pk
|
|
#undef pack_sk
|
|
#undef unpack_sk
|
|
#undef pack_ciphertext
|
|
#undef unpack_ciphertext
|
|
#undef gen_matrix
|
|
#undef indcpa_keypair_derand
|
|
#undef indcpa_enc
|
|
#undef indcpa_dec
|