Rename xof_ to xof128_

The previous commit introduced xof256_ APIs as wrappers around shake256 APIs.
This commit renames the existing shake128 wrappers from xof_ to xof128_ to
make it clearer that it is shake128.

Signed-off-by: Matthias J. Kannwischer <[email protected]>

Author: mkannwischer

mldsa/poly.c

@@ -332,11 +332,11 @@ void poly_uniform(poly *a, const uint8_t seed[MLDSA_SEEDBYTES + 2])
   unsigned int ctr;
   unsigned int buflen = POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES;
   MLD_ALIGN uint8_t buf[POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES];
-  mld_xof_ctx state;
+  mld_xof128_ctx state;
 
-  mld_xof_init(&state);
-  mld_xof_absorb(&state, seed, MLDSA_SEEDBYTES + 2);
-  mld_xof_squeezeblocks(buf, POLY_UNIFORM_NBLOCKS, &state);
+  mld_xof128_init(&state);
+  mld_xof128_absorb(&state, seed, MLDSA_SEEDBYTES + 2);
+  mld_xof128_squeezeblocks(buf, POLY_UNIFORM_NBLOCKS, &state);
 
   ctr = rej_uniform(a->coeffs, MLDSA_N, 0, buf, buflen);
   buflen = STREAM128_BLOCKBYTES;
@@ -347,7 +347,7 @@ void poly_uniform(poly *a, const uint8_t seed[MLDSA_SEEDBYTES + 2])
     invariant((&state)->pos <= SHAKE128_RATE)
     invariant(array_bound(a->coeffs, 0, ctr, 0, MLDSA_Q)))
   {
-    mld_xof_squeezeblocks(buf, 1, &state);
+    mld_xof128_squeezeblocks(buf, 1, &state);
     ctr = rej_uniform(a->coeffs, MLDSA_N, ctr, buf, buflen);
   }
 }
@@ -361,20 +361,20 @@ void poly_uniform_4x(poly *vec,
 
   /* Tracks the number of coefficients we have already sampled */
   unsigned ctr[4];
-  mld_xof_x4_ctx state;
+  mld_xof128_x4_ctx state;
   unsigned buflen;
 
 
-  mld_xof_x4_init(&state);
-  mld_xof_x4_absorb(&state, seed, MLDSA_SEEDBYTES + 2);
+  mld_xof128_x4_init(&state);
+  mld_xof128_x4_absorb(&state, seed, MLDSA_SEEDBYTES + 2);
 
   /*
    * Initially, squeeze heuristic number of POLY_UNIFORM_NBLOCKS.
    * This should generate the matrix entries with high probability.
    */
 
 
-  mld_xof_x4_squeezeblocks(buf, POLY_UNIFORM_NBLOCKS, &state);
+  mld_xof128_x4_squeezeblocks(buf, POLY_UNIFORM_NBLOCKS, &state);
   buflen = POLY_UNIFORM_NBLOCKS * STREAM128_BLOCKBYTES;
   ctr[0] = rej_uniform(vec[0].coeffs, MLDSA_N, 0, buf[0], buflen);
   ctr[1] = rej_uniform(vec[1].coeffs, MLDSA_N, 0, buf[1], buflen);
@@ -390,13 +390,13 @@ void poly_uniform_4x(poly *vec,
   while (ctr[0] < MLDSA_N || ctr[1] < MLDSA_N || ctr[2] < MLDSA_N ||
          ctr[3] < MLDSA_N)
   {
-    mld_xof_x4_squeezeblocks(buf, 1, &state);
+    mld_xof128_x4_squeezeblocks(buf, 1, &state);
     ctr[0] = rej_uniform(vec[0].coeffs, MLDSA_N, ctr[0], buf[0], buflen);
     ctr[1] = rej_uniform(vec[1].coeffs, MLDSA_N, ctr[1], buf[1], buflen);
     ctr[2] = rej_uniform(vec[2].coeffs, MLDSA_N, ctr[2], buf[2], buflen);
     ctr[3] = rej_uniform(vec[3].coeffs, MLDSA_N, ctr[3], buf[3], buflen);
   }
-  mld_xof_x4_release(&state);
+  mld_xof128_x4_release(&state);
 }
 
 /*************************************************

mldsa/symmetric.h

@@ -32,17 +32,17 @@ __contract__(
 #define stream256_squeezeblocks(OUT, OUTBLOCKS, STATE) \
   shake256_squeezeblocks(OUT, OUTBLOCKS, STATE)
 
-#define mld_xof_ctx keccak_state
-#define mld_xof_init(CTX) shake128_init(CTX)
-#define mld_xof_absorb(CTX, IN, INBYTES) \
-  do                                     \
-  {                                      \
-    shake128_absorb(CTX, IN, INBYTES);   \
-    shake128_finalize(CTX);              \
+#define mld_xof128_ctx keccak_state
+#define mld_xof128_init(CTX) shake128_init(CTX)
+#define mld_xof128_absorb(CTX, IN, INBYTES) \
+  do                                        \
+  {                                         \
+    shake128_absorb(CTX, IN, INBYTES);      \
+    shake128_finalize(CTX);                 \
   } while (0)
 
 
-#define mld_xof_squeezeblocks(OUT, OUTBLOCKS, STATE) \
+#define mld_xof128_squeezeblocks(OUT, OUTBLOCKS, STATE) \
   shake128_squeezeblocks(OUT, OUTBLOCKS, STATE)
 
 #define mld_xof256_x4_ctx mld_shake256x4ctx
@@ -55,14 +55,14 @@ __contract__(
                                (NBLOCKS), (CTX))
 #define mld_xof256_x4_release(CTX) mld_shake256x4_release((CTX))
 
-#define mld_xof_x4_ctx mld_shake128x4ctx
-#define mld_xof_x4_init(CTX) mld_shake128x4_init((CTX))
-#define mld_xof_x4_absorb(CTX, IN, INBYTES)                             \
+#define mld_xof128_x4_ctx mld_shake128x4ctx
+#define mld_xof128_x4_init(CTX) mld_shake128x4_init((CTX))
+#define mld_xof128_x4_absorb(CTX, IN, INBYTES)                          \
   mld_shake128x4_absorb_once((CTX), (IN)[0], (IN)[1], (IN)[2], (IN)[3], \
                              (INBYTES))
-#define mld_xof_x4_squeezeblocks(BUF, NBLOCKS, CTX)                    \
+#define mld_xof128_x4_squeezeblocks(BUF, NBLOCKS, CTX)                 \
   mld_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \
                                (NBLOCKS), (CTX))
-#define mld_xof_x4_release(CTX) mld_shake128x4_release((CTX))
+#define mld_xof128_x4_release(CTX) mld_shake128x4_release((CTX))
 
 #endif /* !MLD_SYMMETRIC_H */