mirror of
https://git.savannah.gnu.org/git/grub.git
synced 2026-10-24 16:19:22 +00:00
libgcrypt: Import libgcrypt 1.11
We currently use an old version of libgcrypt which results in us having fewer ciphers and missing on many other improvements. Signed-off-by: Vladimir Serbinenko <phcoder@gmail.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Vladimir Serbinenko authored and Daniel Kiper committed
1 parent
a0d4c94ef6
commit
3312af6e07
468 files changed
+210508
-33178
No files matched your search
@@ -0,0 +1,825 @@
|
||||
/* kyber-kdep.c - the Kyber key encapsulation mechanism (KYBER_K dependent part)
|
||||
* Copyright (C) 2024 g10 Code GmbH
|
||||
*
|
||||
* This file was modified for use by Libgcrypt.
|
||||
*
|
||||
* This file is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Lesser General Public License as
|
||||
* published by the Free Software Foundation; either version 2.1 of
|
||||
* the License, or (at your option) any later version.
|
||||
*
|
||||
* This file is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Lesser General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public
|
||||
* License along with this program; if not, see <https://www.gnu.org/licenses/>.
|
||||
* SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
*
|
||||
* You can also use this file under the same licence of original code.
|
||||
* SPDX-License-Identifier: CC0 OR Apache-2.0
|
||||
*
|
||||
*/
|
||||
/*
|
||||
Original code from:
|
||||
|
||||
Repository: https://github.com/pq-crystals/kyber.git
|
||||
Branch: standard
|
||||
Commit: 11d00ff1f20cfca1f72d819e5a45165c1e0a2816
|
||||
|
||||
Licence:
|
||||
Public Domain (https://creativecommons.org/share-your-work/public-domain/cc0/);
|
||||
or Apache 2.0 License (https://www.apache.org/licenses/LICENSE-2.0.html).
|
||||
|
||||
Authors:
|
||||
Joppe Bos
|
||||
Léo Ducas
|
||||
Eike Kiltz
|
||||
Tancrède Lepoint
|
||||
Vadim Lyubashevsky
|
||||
John Schanck
|
||||
Peter Schwabe
|
||||
Gregor Seiler
|
||||
Damien Stehlé
|
||||
|
||||
Kyber Home: https://www.pq-crystals.org/kyber/
|
||||
*/
|
||||
/*
|
||||
* From original code, following modification was made.
|
||||
*
|
||||
* - C++ style comments are changed to C-style.
|
||||
*
|
||||
* - With the change of "verify" routine (now "verify1"), no negation
|
||||
* for the cmov argument in crypto_kem_dec.
|
||||
*
|
||||
* - Call to xof_init and xof_close are added in gen_matrix.
|
||||
*/
|
||||
|
||||
/*************** kyber/ref/polyvec.h */
|
||||
typedef struct{
|
||||
poly vec[KYBER_K];
|
||||
} polyvec;
|
||||
|
||||
static void polyvec_compress(uint8_t r[KYBER_POLYVECCOMPRESSEDBYTES], const polyvec *a);
|
||||
static void polyvec_decompress(polyvec *r, const uint8_t a[KYBER_POLYVECCOMPRESSEDBYTES]);
|
||||
|
||||
static void polyvec_tobytes(uint8_t r[KYBER_POLYVECBYTES], const polyvec *a);
|
||||
static void polyvec_frombytes(polyvec *r, const uint8_t a[KYBER_POLYVECBYTES]);
|
||||
|
||||
static void polyvec_ntt(polyvec *r);
|
||||
static void polyvec_invntt_tomont(polyvec *r);
|
||||
|
||||
static void polyvec_basemul_acc_montgomery(poly *r, const polyvec *a, const polyvec *b);
|
||||
|
||||
static void polyvec_reduce(polyvec *r);
|
||||
|
||||
static void polyvec_add(polyvec *r, const polyvec *a, const polyvec *b);
|
||||
|
||||
/*************** kyber/ref/indcpa.h */
|
||||
static void gen_matrix(polyvec *a, const uint8_t seed[KYBER_SYMBYTES], int transposed);
|
||||
|
||||
static void indcpa_keypair_derand(uint8_t pk[KYBER_INDCPA_PUBLICKEYBYTES],
|
||||
uint8_t sk[KYBER_INDCPA_SECRETKEYBYTES],
|
||||
const uint8_t coins[KYBER_SYMBYTES]);
|
||||
|
||||
static void indcpa_enc(uint8_t c[KYBER_INDCPA_BYTES],
|
||||
const uint8_t m[KYBER_INDCPA_MSGBYTES],
|
||||
const uint8_t pk[KYBER_INDCPA_PUBLICKEYBYTES],
|
||||
const uint8_t coins[KYBER_SYMBYTES]);
|
||||
|
||||
static void indcpa_dec(uint8_t m[KYBER_INDCPA_MSGBYTES],
|
||||
const uint8_t c[KYBER_INDCPA_BYTES],
|
||||
const uint8_t sk[KYBER_INDCPA_SECRETKEYBYTES]);
|
||||
|
||||
/*************** kyber/ref/kem.h */
|
||||
|
||||
static int crypto_kem_keypair_derand(uint8_t *pk, uint8_t *sk, const uint8_t *coins);
|
||||
|
||||
static int crypto_kem_enc_derand(uint8_t *ct, uint8_t *ss, const uint8_t *pk, const uint8_t *coins);
|
||||
|
||||
/*************** kyber/ref/indcpa.c */
|
||||
|
||||
/*************************************************
|
||||
* Name: pack_pk
|
||||
*
|
||||
* Description: Serialize the public key as concatenation of the
|
||||
* serialized vector of polynomials pk
|
||||
* and the public seed used to generate the matrix A.
|
||||
*
|
||||
* Arguments: uint8_t *r: pointer to the output serialized public key
|
||||
* polyvec *pk: pointer to the input public-key polyvec
|
||||
* const uint8_t *seed: pointer to the input public seed
|
||||
**************************************************/
|
||||
static void pack_pk(uint8_t r[KYBER_INDCPA_PUBLICKEYBYTES],
|
||||
polyvec *pk,
|
||||
const uint8_t seed[KYBER_SYMBYTES])
|
||||
{
|
||||
polyvec_tobytes(r, pk);
|
||||
memcpy(r+KYBER_POLYVECBYTES, seed, KYBER_SYMBYTES);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: unpack_pk
|
||||
*
|
||||
* Description: De-serialize public key from a byte array;
|
||||
* approximate inverse of pack_pk
|
||||
*
|
||||
* Arguments: - polyvec *pk: pointer to output public-key polynomial vector
|
||||
* - uint8_t *seed: pointer to output seed to generate matrix A
|
||||
* - const uint8_t *packedpk: pointer to input serialized public key
|
||||
**************************************************/
|
||||
static void unpack_pk(polyvec *pk,
|
||||
uint8_t seed[KYBER_SYMBYTES],
|
||||
const uint8_t packedpk[KYBER_INDCPA_PUBLICKEYBYTES])
|
||||
{
|
||||
polyvec_frombytes(pk, packedpk);
|
||||
memcpy(seed, packedpk+KYBER_POLYVECBYTES, KYBER_SYMBYTES);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: pack_sk
|
||||
*
|
||||
* Description: Serialize the secret key
|
||||
*
|
||||
* Arguments: - uint8_t *r: pointer to output serialized secret key
|
||||
* - polyvec *sk: pointer to input vector of polynomials (secret key)
|
||||
**************************************************/
|
||||
static void pack_sk(uint8_t r[KYBER_INDCPA_SECRETKEYBYTES], polyvec *sk)
|
||||
{
|
||||
polyvec_tobytes(r, sk);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: unpack_sk
|
||||
*
|
||||
* Description: De-serialize the secret key; inverse of pack_sk
|
||||
*
|
||||
* Arguments: - polyvec *sk: pointer to output vector of polynomials (secret key)
|
||||
* - const uint8_t *packedsk: pointer to input serialized secret key
|
||||
**************************************************/
|
||||
static void unpack_sk(polyvec *sk, const uint8_t packedsk[KYBER_INDCPA_SECRETKEYBYTES])
|
||||
{
|
||||
polyvec_frombytes(sk, packedsk);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: pack_ciphertext
|
||||
*
|
||||
* Description: Serialize the ciphertext as concatenation of the
|
||||
* compressed and serialized vector of polynomials b
|
||||
* and the compressed and serialized polynomial v
|
||||
*
|
||||
* Arguments: uint8_t *r: pointer to the output serialized ciphertext
|
||||
* poly *pk: pointer to the input vector of polynomials b
|
||||
* poly *v: pointer to the input polynomial v
|
||||
**************************************************/
|
||||
static void pack_ciphertext(uint8_t r[KYBER_INDCPA_BYTES], polyvec *b, poly *v)
|
||||
{
|
||||
polyvec_compress(r, b);
|
||||
poly_compress(r+KYBER_POLYVECCOMPRESSEDBYTES, v);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: unpack_ciphertext
|
||||
*
|
||||
* Description: De-serialize and decompress ciphertext from a byte array;
|
||||
* approximate inverse of pack_ciphertext
|
||||
*
|
||||
* Arguments: - polyvec *b: pointer to the output vector of polynomials b
|
||||
* - poly *v: pointer to the output polynomial v
|
||||
* - const uint8_t *c: pointer to the input serialized ciphertext
|
||||
**************************************************/
|
||||
static void unpack_ciphertext(polyvec *b, poly *v, const uint8_t c[KYBER_INDCPA_BYTES])
|
||||
{
|
||||
polyvec_decompress(b, c);
|
||||
poly_decompress(v, c+KYBER_POLYVECCOMPRESSEDBYTES);
|
||||
}
|
||||
|
||||
#define gen_a(A,B) gen_matrix(A,B,0)
|
||||
#define gen_at(A,B) gen_matrix(A,B,1)
|
||||
|
||||
/*************************************************
|
||||
* Name: gen_matrix
|
||||
*
|
||||
* Description: Deterministically generate matrix A (or the transpose of A)
|
||||
* from a seed. Entries of the matrix are polynomials that look
|
||||
* uniformly random. Performs rejection sampling on output of
|
||||
* a XOF
|
||||
*
|
||||
* Arguments: - polyvec *a: pointer to ouptput matrix A
|
||||
* - const uint8_t *seed: pointer to input seed
|
||||
* - int transposed: boolean deciding whether A or A^T is generated
|
||||
**************************************************/
|
||||
#define GEN_MATRIX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES)
|
||||
void gen_matrix(polyvec *a, const uint8_t seed[KYBER_SYMBYTES], int transposed)
|
||||
{
|
||||
unsigned int ctr, i, j, k;
|
||||
unsigned int buflen, off;
|
||||
uint8_t buf[GEN_MATRIX_NBLOCKS*XOF_BLOCKBYTES+2];
|
||||
xof_state state;
|
||||
|
||||
for(i=0;i<KYBER_K;i++) {
|
||||
for(j=0;j<KYBER_K;j++) {
|
||||
xof_init(&state);
|
||||
if(transposed)
|
||||
xof_absorb(&state, seed, i, j);
|
||||
else
|
||||
xof_absorb(&state, seed, j, i);
|
||||
|
||||
xof_squeezeblocks(buf, GEN_MATRIX_NBLOCKS, &state);
|
||||
buflen = GEN_MATRIX_NBLOCKS*XOF_BLOCKBYTES;
|
||||
ctr = rej_uniform(a[i].vec[j].coeffs, KYBER_N, buf, buflen);
|
||||
|
||||
while(ctr < KYBER_N) {
|
||||
off = buflen % 3;
|
||||
for(k = 0; k < off; k++)
|
||||
buf[k] = buf[buflen - off + k];
|
||||
xof_squeezeblocks(buf + off, 1, &state);
|
||||
buflen = off + XOF_BLOCKBYTES;
|
||||
ctr += rej_uniform(a[i].vec[j].coeffs + ctr, KYBER_N - ctr, buf, buflen);
|
||||
}
|
||||
xof_close (&state);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: indcpa_keypair_derand
|
||||
*
|
||||
* Description: Generates public and private key for the CPA-secure
|
||||
* public-key encryption scheme underlying Kyber
|
||||
*
|
||||
* Arguments: - uint8_t *pk: pointer to output public key
|
||||
* (of length KYBER_INDCPA_PUBLICKEYBYTES bytes)
|
||||
* - uint8_t *sk: pointer to output private key
|
||||
* (of length KYBER_INDCPA_SECRETKEYBYTES bytes)
|
||||
* - const uint8_t *coins: pointer to input randomness
|
||||
* (of length KYBER_SYMBYTES bytes)
|
||||
**************************************************/
|
||||
void indcpa_keypair_derand(uint8_t pk[KYBER_INDCPA_PUBLICKEYBYTES],
|
||||
uint8_t sk[KYBER_INDCPA_SECRETKEYBYTES],
|
||||
const uint8_t coins[KYBER_SYMBYTES])
|
||||
{
|
||||
unsigned int i;
|
||||
uint8_t buf[2*KYBER_SYMBYTES];
|
||||
const uint8_t *publicseed = buf;
|
||||
const uint8_t *noiseseed = buf+KYBER_SYMBYTES;
|
||||
uint8_t nonce = 0;
|
||||
polyvec a[KYBER_K], e, pkpv, skpv;
|
||||
|
||||
hash_g(buf, coins, KYBER_SYMBYTES);
|
||||
|
||||
gen_a(a, publicseed);
|
||||
|
||||
for(i=0;i<KYBER_K;i++)
|
||||
poly_getnoise_eta1(&skpv.vec[i], noiseseed, nonce++);
|
||||
for(i=0;i<KYBER_K;i++)
|
||||
poly_getnoise_eta1(&e.vec[i], noiseseed, nonce++);
|
||||
|
||||
polyvec_ntt(&skpv);
|
||||
polyvec_ntt(&e);
|
||||
|
||||
/* matrix-vector multiplication */
|
||||
for(i=0;i<KYBER_K;i++) {
|
||||
polyvec_basemul_acc_montgomery(&pkpv.vec[i], &a[i], &skpv);
|
||||
poly_tomont(&pkpv.vec[i]);
|
||||
}
|
||||
|
||||
polyvec_add(&pkpv, &pkpv, &e);
|
||||
polyvec_reduce(&pkpv);
|
||||
|
||||
pack_sk(sk, &skpv);
|
||||
pack_pk(pk, &pkpv, publicseed);
|
||||
}
|
||||
|
||||
|
||||
/*************************************************
|
||||
* Name: indcpa_enc
|
||||
*
|
||||
* Description: Encryption function of the CPA-secure
|
||||
* public-key encryption scheme underlying Kyber.
|
||||
*
|
||||
* Arguments: - uint8_t *c: pointer to output ciphertext
|
||||
* (of length KYBER_INDCPA_BYTES bytes)
|
||||
* - const uint8_t *m: pointer to input message
|
||||
* (of length KYBER_INDCPA_MSGBYTES bytes)
|
||||
* - const uint8_t *pk: pointer to input public key
|
||||
* (of length KYBER_INDCPA_PUBLICKEYBYTES)
|
||||
* - const uint8_t *coins: pointer to input random coins used as seed
|
||||
* (of length KYBER_SYMBYTES) to deterministically
|
||||
* generate all randomness
|
||||
**************************************************/
|
||||
void indcpa_enc(uint8_t c[KYBER_INDCPA_BYTES],
|
||||
const uint8_t m[KYBER_INDCPA_MSGBYTES],
|
||||
const uint8_t pk[KYBER_INDCPA_PUBLICKEYBYTES],
|
||||
const uint8_t coins[KYBER_SYMBYTES])
|
||||
{
|
||||
unsigned int i;
|
||||
uint8_t seed[KYBER_SYMBYTES];
|
||||
uint8_t nonce = 0;
|
||||
polyvec sp, pkpv, ep, at[KYBER_K], b;
|
||||
poly v, k, epp;
|
||||
|
||||
unpack_pk(&pkpv, seed, pk);
|
||||
poly_frommsg(&k, m);
|
||||
gen_at(at, seed);
|
||||
|
||||
for(i=0;i<KYBER_K;i++)
|
||||
poly_getnoise_eta1(sp.vec+i, coins, nonce++);
|
||||
for(i=0;i<KYBER_K;i++)
|
||||
poly_getnoise_eta2(ep.vec+i, coins, nonce++);
|
||||
poly_getnoise_eta2(&epp, coins, nonce++);
|
||||
|
||||
polyvec_ntt(&sp);
|
||||
|
||||
/* matrix-vector multiplication */
|
||||
for(i=0;i<KYBER_K;i++)
|
||||
polyvec_basemul_acc_montgomery(&b.vec[i], &at[i], &sp);
|
||||
|
||||
polyvec_basemul_acc_montgomery(&v, &pkpv, &sp);
|
||||
|
||||
polyvec_invntt_tomont(&b);
|
||||
poly_invntt_tomont(&v);
|
||||
|
||||
polyvec_add(&b, &b, &ep);
|
||||
poly_add(&v, &v, &epp);
|
||||
poly_add(&v, &v, &k);
|
||||
polyvec_reduce(&b);
|
||||
poly_reduce(&v);
|
||||
|
||||
pack_ciphertext(c, &b, &v);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: indcpa_dec
|
||||
*
|
||||
* Description: Decryption function of the CPA-secure
|
||||
* public-key encryption scheme underlying Kyber.
|
||||
*
|
||||
* Arguments: - uint8_t *m: pointer to output decrypted message
|
||||
* (of length KYBER_INDCPA_MSGBYTES)
|
||||
* - const uint8_t *c: pointer to input ciphertext
|
||||
* (of length KYBER_INDCPA_BYTES)
|
||||
* - const uint8_t *sk: pointer to input secret key
|
||||
* (of length KYBER_INDCPA_SECRETKEYBYTES)
|
||||
**************************************************/
|
||||
void indcpa_dec(uint8_t m[KYBER_INDCPA_MSGBYTES],
|
||||
const uint8_t c[KYBER_INDCPA_BYTES],
|
||||
const uint8_t sk[KYBER_INDCPA_SECRETKEYBYTES])
|
||||
{
|
||||
polyvec b, skpv;
|
||||
poly v, mp;
|
||||
|
||||
unpack_ciphertext(&b, &v, c);
|
||||
unpack_sk(&skpv, sk);
|
||||
|
||||
polyvec_ntt(&b);
|
||||
polyvec_basemul_acc_montgomery(&mp, &skpv, &b);
|
||||
poly_invntt_tomont(&mp);
|
||||
|
||||
poly_sub(&mp, &v, &mp);
|
||||
poly_reduce(&mp);
|
||||
|
||||
poly_tomsg(m, &mp);
|
||||
}
|
||||
|
||||
/*************** kyber/ref/kem.c */
|
||||
/*************************************************
|
||||
* Name: crypto_kem_keypair_derand
|
||||
*
|
||||
* Description: Generates public and private key
|
||||
* for CCA-secure Kyber key encapsulation mechanism
|
||||
*
|
||||
* Arguments: - uint8_t *pk: pointer to output public key
|
||||
* (an already allocated array of KYBER_PUBLICKEYBYTES bytes)
|
||||
* - uint8_t *sk: pointer to output private key
|
||||
* (an already allocated array of KYBER_SECRETKEYBYTES bytes)
|
||||
* - uint8_t *coins: pointer to input randomness
|
||||
* (an already allocated array filled with 2*KYBER_SYMBYTES random bytes)
|
||||
**
|
||||
* Returns 0 (success)
|
||||
**************************************************/
|
||||
int crypto_kem_keypair_derand(uint8_t *pk,
|
||||
uint8_t *sk,
|
||||
const uint8_t *coins)
|
||||
{
|
||||
indcpa_keypair_derand(pk, sk, coins);
|
||||
memcpy(sk+KYBER_INDCPA_SECRETKEYBYTES, pk, KYBER_PUBLICKEYBYTES);
|
||||
hash_h(sk+KYBER_SECRETKEYBYTES-2*KYBER_SYMBYTES, pk, KYBER_PUBLICKEYBYTES);
|
||||
/* Value z for pseudo-random output on reject */
|
||||
memcpy(sk+KYBER_SECRETKEYBYTES-KYBER_SYMBYTES, coins+KYBER_SYMBYTES, KYBER_SYMBYTES);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: crypto_kem_keypair
|
||||
*
|
||||
* Description: Generates public and private key
|
||||
* for CCA-secure Kyber key encapsulation mechanism
|
||||
*
|
||||
* Arguments: - uint8_t *pk: pointer to output public key
|
||||
* (an already allocated array of KYBER_PUBLICKEYBYTES bytes)
|
||||
* - uint8_t *sk: pointer to output private key
|
||||
* (an already allocated array of KYBER_SECRETKEYBYTES bytes)
|
||||
*
|
||||
* Returns 0 (success)
|
||||
**************************************************/
|
||||
int crypto_kem_keypair(uint8_t *pk,
|
||||
uint8_t *sk)
|
||||
{
|
||||
uint8_t coins[2*KYBER_SYMBYTES];
|
||||
randombytes(coins, 2*KYBER_SYMBYTES);
|
||||
crypto_kem_keypair_derand(pk, sk, coins);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: crypto_kem_enc_derand
|
||||
*
|
||||
* Description: Generates cipher text and shared
|
||||
* secret for given public key
|
||||
*
|
||||
* Arguments: - uint8_t *ct: pointer to output cipher text
|
||||
* (an already allocated array of KYBER_CIPHERTEXTBYTES bytes)
|
||||
* - uint8_t *ss: pointer to output shared secret
|
||||
* (an already allocated array of KYBER_SSBYTES bytes)
|
||||
* - const uint8_t *pk: pointer to input public key
|
||||
* (an already allocated array of KYBER_PUBLICKEYBYTES bytes)
|
||||
* - const uint8_t *coins: pointer to input randomness
|
||||
* (an already allocated array filled with KYBER_SYMBYTES random bytes)
|
||||
**
|
||||
* Returns 0 (success)
|
||||
**************************************************/
|
||||
int crypto_kem_enc_derand(uint8_t *ct,
|
||||
uint8_t *ss,
|
||||
const uint8_t *pk,
|
||||
const uint8_t *coins)
|
||||
{
|
||||
uint8_t buf[2*KYBER_SYMBYTES];
|
||||
/* Will contain key, coins */
|
||||
uint8_t kr[2*KYBER_SYMBYTES];
|
||||
|
||||
memcpy(buf, coins, KYBER_SYMBYTES);
|
||||
|
||||
/* Multitarget countermeasure for coins + contributory KEM */
|
||||
hash_h(buf+KYBER_SYMBYTES, pk, KYBER_PUBLICKEYBYTES);
|
||||
hash_g(kr, buf, 2*KYBER_SYMBYTES);
|
||||
|
||||
/* coins are in kr+KYBER_SYMBYTES */
|
||||
indcpa_enc(ct, buf, pk, kr+KYBER_SYMBYTES);
|
||||
|
||||
memcpy(ss,kr,KYBER_SYMBYTES);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: crypto_kem_enc
|
||||
*
|
||||
* Description: Generates cipher text and shared
|
||||
* secret for given public key
|
||||
*
|
||||
* Arguments: - uint8_t *ct: pointer to output cipher text
|
||||
* (an already allocated array of KYBER_CIPHERTEXTBYTES bytes)
|
||||
* - uint8_t *ss: pointer to output shared secret
|
||||
* (an already allocated array of KYBER_SSBYTES bytes)
|
||||
* - const uint8_t *pk: pointer to input public key
|
||||
* (an already allocated array of KYBER_PUBLICKEYBYTES bytes)
|
||||
*
|
||||
* Returns 0 (success)
|
||||
**************************************************/
|
||||
int crypto_kem_enc(uint8_t *ct,
|
||||
uint8_t *ss,
|
||||
const uint8_t *pk)
|
||||
{
|
||||
uint8_t coins[KYBER_SYMBYTES];
|
||||
randombytes(coins, KYBER_SYMBYTES);
|
||||
crypto_kem_enc_derand(ct, ss, pk, coins);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: crypto_kem_dec
|
||||
*
|
||||
* Description: Generates shared secret for given
|
||||
* cipher text and private key
|
||||
*
|
||||
* Arguments: - uint8_t *ss: pointer to output shared secret
|
||||
* (an already allocated array of KYBER_SSBYTES bytes)
|
||||
* - const uint8_t *ct: pointer to input cipher text
|
||||
* (an already allocated array of KYBER_CIPHERTEXTBYTES bytes)
|
||||
* - const uint8_t *sk: pointer to input private key
|
||||
* (an already allocated array of KYBER_SECRETKEYBYTES bytes)
|
||||
*
|
||||
* Returns 0.
|
||||
*
|
||||
* On failure, ss will contain a pseudo-random value.
|
||||
**************************************************/
|
||||
int crypto_kem_dec(uint8_t *ss,
|
||||
const uint8_t *ct,
|
||||
const uint8_t *sk)
|
||||
{
|
||||
unsigned int success;
|
||||
uint8_t buf[2*KYBER_SYMBYTES];
|
||||
/* Will contain key, coins */
|
||||
uint8_t kr[2*KYBER_SYMBYTES];
|
||||
uint8_t cmp[KYBER_CIPHERTEXTBYTES+KYBER_SYMBYTES];
|
||||
const uint8_t *pk = sk+KYBER_INDCPA_SECRETKEYBYTES;
|
||||
|
||||
indcpa_dec(buf, ct, sk);
|
||||
|
||||
/* Multitarget countermeasure for coins + contributory KEM */
|
||||
memcpy(buf+KYBER_SYMBYTES, sk+KYBER_SECRETKEYBYTES-2*KYBER_SYMBYTES, KYBER_SYMBYTES);
|
||||
hash_g(kr, buf, 2*KYBER_SYMBYTES);
|
||||
|
||||
/* coins are in kr+KYBER_SYMBYTES */
|
||||
indcpa_enc(cmp, buf, pk, kr+KYBER_SYMBYTES);
|
||||
|
||||
success = verify1(ct, cmp, KYBER_CIPHERTEXTBYTES);
|
||||
|
||||
/* Compute rejection key */
|
||||
rkprf(ss,sk+KYBER_SECRETKEYBYTES-KYBER_SYMBYTES,ct);
|
||||
|
||||
/* Copy true key to return buffer if fail is false */
|
||||
cmov(ss,kr,KYBER_SYMBYTES,success);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*************** kyber/ref/polyvec.c */
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_compress
|
||||
*
|
||||
* Description: Compress and serialize vector of polynomials
|
||||
*
|
||||
* Arguments: - uint8_t *r: pointer to output byte array
|
||||
* (needs space for KYBER_POLYVECCOMPRESSEDBYTES)
|
||||
* - const polyvec *a: pointer to input vector of polynomials
|
||||
**************************************************/
|
||||
void polyvec_compress(uint8_t r[KYBER_POLYVECCOMPRESSEDBYTES], const polyvec *a)
|
||||
{
|
||||
unsigned int i,j,k;
|
||||
uint64_t d0;
|
||||
|
||||
#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352))
|
||||
uint16_t t[8];
|
||||
for(i=0;i<KYBER_K;i++) {
|
||||
for(j=0;j<KYBER_N/8;j++) {
|
||||
for(k=0;k<8;k++) {
|
||||
t[k] = a->vec[i].coeffs[8*j+k];
|
||||
t[k] += ((int16_t)t[k] >> 15) & KYBER_Q;
|
||||
/* t[k] = ((((uint32_t)t[k] << 11) + KYBER_Q/2)/KYBER_Q) & 0x7ff; */
|
||||
d0 = t[k];
|
||||
d0 <<= 11;
|
||||
d0 += 1664;
|
||||
d0 *= 645084;
|
||||
d0 >>= 31;
|
||||
t[k] = d0 & 0x7ff;
|
||||
|
||||
}
|
||||
|
||||
r[ 0] = (t[0] >> 0);
|
||||
r[ 1] = (t[0] >> 8) | (t[1] << 3);
|
||||
r[ 2] = (t[1] >> 5) | (t[2] << 6);
|
||||
r[ 3] = (t[2] >> 2);
|
||||
r[ 4] = (t[2] >> 10) | (t[3] << 1);
|
||||
r[ 5] = (t[3] >> 7) | (t[4] << 4);
|
||||
r[ 6] = (t[4] >> 4) | (t[5] << 7);
|
||||
r[ 7] = (t[5] >> 1);
|
||||
r[ 8] = (t[5] >> 9) | (t[6] << 2);
|
||||
r[ 9] = (t[6] >> 6) | (t[7] << 5);
|
||||
r[10] = (t[7] >> 3);
|
||||
r += 11;
|
||||
}
|
||||
}
|
||||
#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320))
|
||||
uint16_t t[4];
|
||||
for(i=0;i<KYBER_K;i++) {
|
||||
for(j=0;j<KYBER_N/4;j++) {
|
||||
for(k=0;k<4;k++) {
|
||||
t[k] = a->vec[i].coeffs[4*j+k];
|
||||
t[k] += ((int16_t)t[k] >> 15) & KYBER_Q;
|
||||
/* t[k] = ((((uint32_t)t[k] << 10) + KYBER_Q/2)/ KYBER_Q) & 0x3ff; */
|
||||
d0 = t[k];
|
||||
d0 <<= 10;
|
||||
d0 += 1665;
|
||||
d0 *= 1290167;
|
||||
d0 >>= 32;
|
||||
t[k] = d0 & 0x3ff;
|
||||
}
|
||||
|
||||
r[0] = (t[0] >> 0);
|
||||
r[1] = (t[0] >> 8) | (t[1] << 2);
|
||||
r[2] = (t[1] >> 6) | (t[2] << 4);
|
||||
r[3] = (t[2] >> 4) | (t[3] << 6);
|
||||
r[4] = (t[3] >> 2);
|
||||
r += 5;
|
||||
}
|
||||
}
|
||||
#else
|
||||
#error "KYBER_POLYVECCOMPRESSEDBYTES needs to be in {320*KYBER_K, 352*KYBER_K}"
|
||||
#endif
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_decompress
|
||||
*
|
||||
* Description: De-serialize and decompress vector of polynomials;
|
||||
* approximate inverse of polyvec_compress
|
||||
*
|
||||
* Arguments: - polyvec *r: pointer to output vector of polynomials
|
||||
* - const uint8_t *a: pointer to input byte array
|
||||
* (of length KYBER_POLYVECCOMPRESSEDBYTES)
|
||||
**************************************************/
|
||||
void polyvec_decompress(polyvec *r, const uint8_t a[KYBER_POLYVECCOMPRESSEDBYTES])
|
||||
{
|
||||
unsigned int i,j,k;
|
||||
|
||||
#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352))
|
||||
uint16_t t[8];
|
||||
for(i=0;i<KYBER_K;i++) {
|
||||
for(j=0;j<KYBER_N/8;j++) {
|
||||
t[0] = (a[0] >> 0) | ((uint16_t)a[ 1] << 8);
|
||||
t[1] = (a[1] >> 3) | ((uint16_t)a[ 2] << 5);
|
||||
t[2] = (a[2] >> 6) | ((uint16_t)a[ 3] << 2) | ((uint16_t)a[4] << 10);
|
||||
t[3] = (a[4] >> 1) | ((uint16_t)a[ 5] << 7);
|
||||
t[4] = (a[5] >> 4) | ((uint16_t)a[ 6] << 4);
|
||||
t[5] = (a[6] >> 7) | ((uint16_t)a[ 7] << 1) | ((uint16_t)a[8] << 9);
|
||||
t[6] = (a[8] >> 2) | ((uint16_t)a[ 9] << 6);
|
||||
t[7] = (a[9] >> 5) | ((uint16_t)a[10] << 3);
|
||||
a += 11;
|
||||
|
||||
for(k=0;k<8;k++)
|
||||
r->vec[i].coeffs[8*j+k] = ((uint32_t)(t[k] & 0x7FF)*KYBER_Q + 1024) >> 11;
|
||||
}
|
||||
}
|
||||
#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320))
|
||||
uint16_t t[4];
|
||||
for(i=0;i<KYBER_K;i++) {
|
||||
for(j=0;j<KYBER_N/4;j++) {
|
||||
t[0] = (a[0] >> 0) | ((uint16_t)a[1] << 8);
|
||||
t[1] = (a[1] >> 2) | ((uint16_t)a[2] << 6);
|
||||
t[2] = (a[2] >> 4) | ((uint16_t)a[3] << 4);
|
||||
t[3] = (a[3] >> 6) | ((uint16_t)a[4] << 2);
|
||||
a += 5;
|
||||
|
||||
for(k=0;k<4;k++)
|
||||
r->vec[i].coeffs[4*j+k] = ((uint32_t)(t[k] & 0x3FF)*KYBER_Q + 512) >> 10;
|
||||
}
|
||||
}
|
||||
#else
|
||||
#error "KYBER_POLYVECCOMPRESSEDBYTES needs to be in {320*KYBER_K, 352*KYBER_K}"
|
||||
#endif
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_tobytes
|
||||
*
|
||||
* Description: Serialize vector of polynomials
|
||||
*
|
||||
* Arguments: - uint8_t *r: pointer to output byte array
|
||||
* (needs space for KYBER_POLYVECBYTES)
|
||||
* - const polyvec *a: pointer to input vector of polynomials
|
||||
**************************************************/
|
||||
void polyvec_tobytes(uint8_t r[KYBER_POLYVECBYTES], const polyvec *a)
|
||||
{
|
||||
unsigned int i;
|
||||
for(i=0;i<KYBER_K;i++)
|
||||
poly_tobytes(r+i*KYBER_POLYBYTES, &a->vec[i]);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_frombytes
|
||||
*
|
||||
* Description: De-serialize vector of polynomials;
|
||||
* inverse of polyvec_tobytes
|
||||
*
|
||||
* Arguments: - uint8_t *r: pointer to output byte array
|
||||
* - const polyvec *a: pointer to input vector of polynomials
|
||||
* (of length KYBER_POLYVECBYTES)
|
||||
**************************************************/
|
||||
void polyvec_frombytes(polyvec *r, const uint8_t a[KYBER_POLYVECBYTES])
|
||||
{
|
||||
unsigned int i;
|
||||
for(i=0;i<KYBER_K;i++)
|
||||
poly_frombytes(&r->vec[i], a+i*KYBER_POLYBYTES);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_ntt
|
||||
*
|
||||
* Description: Apply forward NTT to all elements of a vector of polynomials
|
||||
*
|
||||
* Arguments: - polyvec *r: pointer to in/output vector of polynomials
|
||||
**************************************************/
|
||||
void polyvec_ntt(polyvec *r)
|
||||
{
|
||||
unsigned int i;
|
||||
for(i=0;i<KYBER_K;i++)
|
||||
poly_ntt(&r->vec[i]);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_invntt_tomont
|
||||
*
|
||||
* Description: Apply inverse NTT to all elements of a vector of polynomials
|
||||
* and multiply by Montgomery factor 2^16
|
||||
*
|
||||
* Arguments: - polyvec *r: pointer to in/output vector of polynomials
|
||||
**************************************************/
|
||||
void polyvec_invntt_tomont(polyvec *r)
|
||||
{
|
||||
unsigned int i;
|
||||
for(i=0;i<KYBER_K;i++)
|
||||
poly_invntt_tomont(&r->vec[i]);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_basemul_acc_montgomery
|
||||
*
|
||||
* Description: Multiply elements of a and b in NTT domain, accumulate into r,
|
||||
* and multiply by 2^-16.
|
||||
*
|
||||
* Arguments: - poly *r: pointer to output polynomial
|
||||
* - const polyvec *a: pointer to first input vector of polynomials
|
||||
* - const polyvec *b: pointer to second input vector of polynomials
|
||||
**************************************************/
|
||||
void polyvec_basemul_acc_montgomery(poly *r, const polyvec *a, const polyvec *b)
|
||||
{
|
||||
unsigned int i;
|
||||
poly t;
|
||||
|
||||
poly_basemul_montgomery(r, &a->vec[0], &b->vec[0]);
|
||||
for(i=1;i<KYBER_K;i++) {
|
||||
poly_basemul_montgomery(&t, &a->vec[i], &b->vec[i]);
|
||||
poly_add(r, r, &t);
|
||||
}
|
||||
|
||||
poly_reduce(r);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_reduce
|
||||
*
|
||||
* Description: Applies Barrett reduction to each coefficient
|
||||
* of each element of a vector of polynomials;
|
||||
* for details of the Barrett reduction see comments in reduce.c
|
||||
*
|
||||
* Arguments: - polyvec *r: pointer to input/output polynomial
|
||||
**************************************************/
|
||||
void polyvec_reduce(polyvec *r)
|
||||
{
|
||||
unsigned int i;
|
||||
for(i=0;i<KYBER_K;i++)
|
||||
poly_reduce(&r->vec[i]);
|
||||
}
|
||||
|
||||
/*************************************************
|
||||
* Name: polyvec_add
|
||||
*
|
||||
* Description: Add vectors of polynomials
|
||||
*
|
||||
* Arguments: - polyvec *r: pointer to output vector of polynomials
|
||||
* - const polyvec *a: pointer to first input vector of polynomials
|
||||
* - const polyvec *b: pointer to second input vector of polynomials
|
||||
**************************************************/
|
||||
void polyvec_add(polyvec *r, const polyvec *a, const polyvec *b)
|
||||
{
|
||||
unsigned int i;
|
||||
for(i=0;i<KYBER_K;i++)
|
||||
poly_add(&r->vec[i], &a->vec[i], &b->vec[i]);
|
||||
}
|
||||
|
||||
/*****************/
|
||||
#undef KYBER_K
|
||||
#undef KYBER_POLYCOMPRESSEDBYTES
|
||||
#undef KYBER_POLYVECCOMPRESSEDBYTES
|
||||
#undef poly_compress
|
||||
#undef poly_decompress
|
||||
#undef poly_getnoise_eta1
|
||||
#undef crypto_kem_keypair_derand
|
||||
#undef crypto_kem_enc_derand
|
||||
#undef crypto_kem_keypair
|
||||
#undef crypto_kem_enc
|
||||
#undef crypto_kem_dec
|
||||
#undef polyvec
|
||||
#undef polyvec_compress
|
||||
#undef polyvec_decompress
|
||||
#undef polyvec_tobytes
|
||||
#undef polyvec_frombytes
|
||||
#undef polyvec_ntt
|
||||
#undef polyvec_invntt_tomont
|
||||
#undef polyvec_basemul_acc_montgomery
|
||||
#undef polyvec_reduce
|
||||
#undef polyvec_add
|
||||
#undef pack_pk
|
||||
#undef unpack_pk
|
||||
#undef pack_sk
|
||||
#undef unpack_sk
|
||||
#undef pack_ciphertext
|
||||
#undef unpack_ciphertext
|
||||
#undef gen_matrix
|
||||
#undef indcpa_keypair_derand
|
||||
#undef indcpa_enc
|
||||
#undef indcpa_dec
|
||||
Reference in new issue
Block a user