Skip to content

Commit 840073a

Browse files
authored
Merge pull request #262 from pq-code-package/native-polyvecl-pointwise
Refactor polyvecl_pointwise_acc_montgomery in preparation of native code
2 parents e2d3ea1 + 2fda060 commit 840073a

File tree

2 files changed

+20
-8
lines changed

2 files changed

+20
-8
lines changed

mldsa/polyvec.c

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -191,14 +191,22 @@ void polyvecl_pointwise_poly_montgomery(polyvecl *r, const poly *a,
191191
void polyvecl_pointwise_acc_montgomery(poly *w, const polyvecl *u,
192192
const polyvecl *v)
193193
{
194-
unsigned int i;
195-
poly t;
194+
unsigned int i, j;
195+
/* The second input is bounded by 9q. Hence, we can safely accumulate
196+
* in 64-bits without intermediate reductions as
197+
* MLDSA_L * MLD_NTT_BOUND * INT32_MAX < INT64_MAX
198+
* worst case is ML-DSA-87: 7 * 9 * q * 2**31 < 2**63
199+
* (likewise for negative values)
200+
*/
196201

197-
poly_pointwise_montgomery(w, &u->vec[0], &v->vec[0]);
198-
for (i = 1; i < MLDSA_L; ++i)
202+
for (i = 0; i < MLDSA_N; i++)
199203
{
200-
poly_pointwise_montgomery(&t, &u->vec[i], &v->vec[i]);
201-
poly_add(w, w, &t);
204+
int64_t t = 0;
205+
for (j = 0; j < MLDSA_L; j++)
206+
{
207+
t += (int64_t)u->vec[j].coeffs[i] * (int64_t)v->vec[j].coeffs[i];
208+
}
209+
w->coeffs[i] = montgomery_reduce(t);
202210
}
203211
}
204212

mldsa/polyvec.h

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -146,8 +146,12 @@ __contract__(
146146
* Name: polyvecl_pointwise_acc_montgomery
147147
*
148148
* Description: Pointwise multiply vectors of polynomials of length MLDSA_L,
149-
*multiply resulting vector by 2^{-32} and add (accumulate) polynomials in it.
150-
*Input/output vectors are in NTT domain representation.
149+
* multiply resulting vector by 2^{-32} and add (accumulate)
150+
* polynomials in it.
151+
* Input/output vectors are in NTT domain representation.
152+
* The second input is assumed to be output of an NTT, and
153+
* hence must have coefficients bounded by (-9q, +9q).
154+
*
151155
*
152156
* Arguments: - poly *w: output polynomial
153157
* - const polyvecl *u: pointer to first input vector

0 commit comments

Comments
 (0)