Skip to content
This repository was archived by the owner on Nov 6, 2024. It is now read-only.

Commit b8e82ea

Browse files
planetf1planetf1
committed
Initial code from pqcrystals/kyber /ref @ 10b478fc3cc4ff6215eb0b6a11bd758bf0929cbd
Signed-off-by: Nigel Jones <[email protected]>
1 parent c360763 commit b8e82ea

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

54 files changed

+3944
-0
lines changed

‎src/.gitignore

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
*.so
2+
*.o
3+
test/test_kyber1024
4+
test/test_kyber512
5+
test/test_kyber768
6+
test/test_speed1024
7+
test/test_speed512
8+
test/test_speed768
9+
test/test_vectors1024
10+
test/test_vectors512
11+
test/test_vectors768
12+
nistkat/PQCgenKAT_kem512
13+
nistkat/PQCgenKAT_kem768
14+
nistkat/PQCgenKAT_kem1024
15+
nistkat/*.req
16+
nistkat/*.rsp

‎src/Makefile

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
CC ?= /usr/bin/cc
2+
CFLAGS += -Wall -Wextra -Wpedantic -Wmissing-prototypes -Wredundant-decls \
3+
-Wshadow -Wpointer-arith -O3 -fomit-frame-pointer -z noexecstack
4+
NISTFLAGS += -Wno-unused-result -O3 -fomit-frame-pointer
5+
RM = /bin/rm
6+
7+
SOURCES = kem.c indcpa.c polyvec.c poly.c ntt.c cbd.c reduce.c verify.c
8+
SOURCESKECCAK = $(SOURCES) fips202.c symmetric-shake.c
9+
HEADERS = params.h kem.h indcpa.h polyvec.h poly.h ntt.h cbd.h reduce.c verify.h symmetric.h
10+
HEADERSKECCAK = $(HEADERS) fips202.h
11+
12+
.PHONY: all speed shared clean
13+
14+
all: test speed shared nistkat
15+
16+
test: \
17+
test/test_kyber512 \
18+
test/test_kyber768 \
19+
test/test_kyber1024 \
20+
test/test_vectors512 \
21+
test/test_vectors768 \
22+
test/test_vectors1024 \
23+
24+
speed: \
25+
test/test_speed512 \
26+
test/test_speed768 \
27+
test/test_speed1024 \
28+
29+
shared: \
30+
lib/libpqcrystals_kyber512_ref.so \
31+
lib/libpqcrystals_kyber768_ref.so \
32+
lib/libpqcrystals_kyber1024_ref.so \
33+
lib/libpqcrystals_fips202_ref.so \
34+
35+
nistkat: \
36+
nistkat/PQCgenKAT_kem512 \
37+
nistkat/PQCgenKAT_kem768 \
38+
nistkat/PQCgenKAT_kem1024 \
39+
40+
41+
lib/libpqcrystals_fips202_ref.so: fips202.c fips202.h
42+
mkdir -p lib
43+
$(CC) -shared -fPIC $(CFLAGS) fips202.c -o $@
44+
45+
lib/libpqcrystals_kyber512_ref.so: $(SOURCES) $(HEADERS) symmetric-shake.c
46+
mkdir -p lib
47+
$(CC) -shared -fPIC $(CFLAGS) -DKYBER_K=2 $(SOURCES) symmetric-shake.c -o $@
48+
49+
lib/libpqcrystals_kyber768_ref.so: $(SOURCES) $(HEADERS) symmetric-shake.c
50+
mkdir -p lib
51+
$(CC) -shared -fPIC $(CFLAGS) -DKYBER_K=3 $(SOURCES) symmetric-shake.c -o $@
52+
53+
lib/libpqcrystals_kyber1024_ref.so: $(SOURCES) $(HEADERS) symmetric-shake.c
54+
mkdir -p lib
55+
$(CC) -shared -fPIC $(CFLAGS) -DKYBER_K=4 $(SOURCES) symmetric-shake.c -o $@
56+
57+
test/test_kyber512: $(SOURCESKECCAK) $(HEADERSKECCAK) test/test_kyber.c randombytes.c
58+
$(CC) $(CFLAGS) -DKYBER_K=2 $(SOURCESKECCAK) randombytes.c test/test_kyber.c -o $@
59+
60+
test/test_kyber768: $(SOURCESKECCAK) $(HEADERSKECCAK) test/test_kyber.c randombytes.c
61+
$(CC) $(CFLAGS) -DKYBER_K=3 $(SOURCESKECCAK) randombytes.c test/test_kyber.c -o $@
62+
63+
test/test_kyber1024: $(SOURCESKECCAK) $(HEADERSKECCAK) test/test_kyber.c randombytes.c
64+
$(CC) $(CFLAGS) -DKYBER_K=4 $(SOURCESKECCAK) randombytes.c test/test_kyber.c -o $@
65+
66+
test/test_vectors512: $(SOURCESKECCAK) $(HEADERSKECCAK) test/test_vectors.c
67+
$(CC) $(CFLAGS) -DKYBER_K=2 $(SOURCESKECCAK) test/test_vectors.c -o $@
68+
69+
test/test_vectors768: $(SOURCESKECCAK) $(HEADERSKECCAK) test/test_vectors.c
70+
$(CC) $(CFLAGS) -DKYBER_K=3 $(SOURCESKECCAK) test/test_vectors.c -o $@
71+
72+
test/test_vectors1024: $(SOURCESKECCAK) $(HEADERSKECCAK) test/test_vectors.c
73+
$(CC) $(CFLAGS) -DKYBER_K=4 $(SOURCESKECCAK) test/test_vectors.c -o $@
74+
75+
test/test_speed512: $(SOURCESKECCAK) $(HEADERSKECCAK) test/cpucycles.h test/cpucycles.c test/speed_print.h test/speed_print.c test/test_speed.c randombytes.c
76+
$(CC) $(CFLAGS) -DKYBER_K=2 $(SOURCESKECCAK) randombytes.c test/cpucycles.c test/speed_print.c test/test_speed.c -o $@
77+
78+
test/test_speed768: $(SOURCESKECCAK) $(HEADERSKECCAK) test/cpucycles.h test/cpucycles.c test/speed_print.h test/speed_print.c test/test_speed.c randombytes.c
79+
$(CC) $(CFLAGS) -DKYBER_K=3 $(SOURCESKECCAK) randombytes.c test/cpucycles.c test/speed_print.c test/test_speed.c -o $@
80+
81+
test/test_speed1024: $(SOURCESKECCAK) $(HEADERSKECCAK) test/cpucycles.h test/cpucycles.c test/speed_print.h test/speed_print.c test/test_speed.c randombytes.c
82+
$(CC) $(CFLAGS) -DKYBER_K=4 $(SOURCESKECCAK) randombytes.c test/cpucycles.c test/speed_print.c test/test_speed.c -o $@
83+
84+
nistkat/PQCgenKAT_kem512: $(SOURCESKECCAK) $(HEADERSKECCAK) nistkat/PQCgenKAT_kem.c nistkat/rng.c nistkat/rng.h
85+
$(CC) $(NISTFLAGS) -DKYBER_K=2 -o $@ $(SOURCESKECCAK) nistkat/rng.c nistkat/PQCgenKAT_kem.c $(LDFLAGS) -lcrypto
86+
87+
nistkat/PQCgenKAT_kem768: $(SOURCESKECCAK) $(HEADERSKECCAK) nistkat/PQCgenKAT_kem.c nistkat/rng.c nistkat/rng.h
88+
$(CC) $(NISTFLAGS) -DKYBER_K=3 -o $@ $(SOURCESKECCAK) nistkat/rng.c nistkat/PQCgenKAT_kem.c $(LDFLAGS) -lcrypto
89+
90+
nistkat/PQCgenKAT_kem1024: $(SOURCESKECCAK) $(HEADERSKECCAK) nistkat/PQCgenKAT_kem.c nistkat/rng.c nistkat/rng.h
91+
$(CC) $(NISTFLAGS) -DKYBER_K=4 -o $@ $(SOURCESKECCAK) nistkat/rng.c nistkat/PQCgenKAT_kem.c $(LDFLAGS) -lcrypto
92+
93+
clean:
94+
-$(RM) -f *.gcno *.gcda *.lcov *.o *.so
95+
-$(RM) -f test/test_kyber512
96+
-$(RM) -f test/test_kyber768
97+
-$(RM) -f test/test_kyber1024
98+
-$(RM) -f test/test_vectors512
99+
-$(RM) -f test/test_vectors768
100+
-$(RM) -f test/test_vectors1024
101+
-$(RM) -f test/test_speed512
102+
-$(RM) -f test/test_speed768
103+
-$(RM) -f test/test_speed1024
104+
-$(RM) -f nistkat/PQCgenKAT_kem512
105+
-$(RM) -f nistkat/PQCgenKAT_kem768
106+
-$(RM) -f nistkat/PQCgenKAT_kem1024
107+
-$(RM) -f nistkat/*.req
108+
-$(RM) -f nistkat/*.rsp
109+
-$(RM) -rf lib/
110+

‎src/api.h

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
#ifndef API_H
2+
#define API_H
3+
4+
#include <stdint.h>
5+
6+
#define pqcrystals_kyber512_SECRETKEYBYTES 1632
7+
#define pqcrystals_kyber512_PUBLICKEYBYTES 800
8+
#define pqcrystals_kyber512_CIPHERTEXTBYTES 768
9+
#define pqcrystals_kyber512_KEYPAIRCOINBYTES 64
10+
#define pqcrystals_kyber512_ENCCOINBYTES 32
11+
#define pqcrystals_kyber512_BYTES 32
12+
13+
#define pqcrystals_kyber512_ref_SECRETKEYBYTES pqcrystals_kyber512_SECRETKEYBYTES
14+
#define pqcrystals_kyber512_ref_PUBLICKEYBYTES pqcrystals_kyber512_PUBLICKEYBYTES
15+
#define pqcrystals_kyber512_ref_CIPHERTEXTBYTES pqcrystals_kyber512_CIPHERTEXTBYTES
16+
#define pqcrystals_kyber512_ref_KEYPAIRCOINBYTES pqcrystals_kyber512_KEYPAIRCOINBYTES
17+
#define pqcrystals_kyber512_ref_ENCCOINBYTES pqcrystals_kyber512_ENCCOINBYTES
18+
#define pqcrystals_kyber512_ref_BYTES pqcrystals_kyber512_BYTES
19+
20+
int pqcrystals_kyber512_ref_keypair_derand(uint8_t *pk, uint8_t *sk, const uint8_t *coins);
21+
int pqcrystals_kyber512_ref_keypair(uint8_t *pk, uint8_t *sk);
22+
int pqcrystals_kyber512_ref_enc_derand(uint8_t *ct, uint8_t *ss, const uint8_t *pk, const uint8_t *coins);
23+
int pqcrystals_kyber512_ref_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk);
24+
int pqcrystals_kyber512_ref_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk);
25+
26+
#define pqcrystals_kyber768_SECRETKEYBYTES 2400
27+
#define pqcrystals_kyber768_PUBLICKEYBYTES 1184
28+
#define pqcrystals_kyber768_CIPHERTEXTBYTES 1088
29+
#define pqcrystals_kyber768_KEYPAIRCOINBYTES 64
30+
#define pqcrystals_kyber768_ENCCOINBYTES 32
31+
#define pqcrystals_kyber768_BYTES 32
32+
33+
#define pqcrystals_kyber768_ref_SECRETKEYBYTES pqcrystals_kyber768_SECRETKEYBYTES
34+
#define pqcrystals_kyber768_ref_PUBLICKEYBYTES pqcrystals_kyber768_PUBLICKEYBYTES
35+
#define pqcrystals_kyber768_ref_CIPHERTEXTBYTES pqcrystals_kyber768_CIPHERTEXTBYTES
36+
#define pqcrystals_kyber768_ref_KEYPAIRCOINBYTES pqcrystals_kyber768_KEYPAIRCOINBYTES
37+
#define pqcrystals_kyber768_ref_ENCCOINBYTES pqcrystals_kyber768_ENCCOINBYTES
38+
#define pqcrystals_kyber768_ref_BYTES pqcrystals_kyber768_BYTES
39+
40+
int pqcrystals_kyber768_ref_keypair_derand(uint8_t *pk, uint8_t *sk, const uint8_t *coins);
41+
int pqcrystals_kyber768_ref_keypair(uint8_t *pk, uint8_t *sk);
42+
int pqcrystals_kyber768_ref_enc_derand(uint8_t *ct, uint8_t *ss, const uint8_t *pk, const uint8_t *coins);
43+
int pqcrystals_kyber768_ref_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk);
44+
int pqcrystals_kyber768_ref_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk);
45+
46+
#define pqcrystals_kyber1024_SECRETKEYBYTES 3168
47+
#define pqcrystals_kyber1024_PUBLICKEYBYTES 1568
48+
#define pqcrystals_kyber1024_CIPHERTEXTBYTES 1568
49+
#define pqcrystals_kyber1024_KEYPAIRCOINBYTES 64
50+
#define pqcrystals_kyber1024_ENCCOINBYTES 32
51+
#define pqcrystals_kyber1024_BYTES 32
52+
53+
#define pqcrystals_kyber1024_ref_SECRETKEYBYTES pqcrystals_kyber1024_SECRETKEYBYTES
54+
#define pqcrystals_kyber1024_ref_PUBLICKEYBYTES pqcrystals_kyber1024_PUBLICKEYBYTES
55+
#define pqcrystals_kyber1024_ref_CIPHERTEXTBYTES pqcrystals_kyber1024_CIPHERTEXTBYTES
56+
#define pqcrystals_kyber1024_ref_KEYPAIRCOINBYTES pqcrystals_kyber1024_KEYPAIRCOINBYTES
57+
#define pqcrystals_kyber1024_ref_ENCCOINBYTES pqcrystals_kyber1024_ENCCOINBYTES
58+
#define pqcrystals_kyber1024_ref_BYTES pqcrystals_kyber1024_BYTES
59+
60+
int pqcrystals_kyber1024_ref_keypair_derand(uint8_t *pk, uint8_t *sk, const uint8_t *coins);
61+
int pqcrystals_kyber1024_ref_keypair(uint8_t *pk, uint8_t *sk);
62+
int pqcrystals_kyber1024_ref_enc_derand(uint8_t *ct, uint8_t *ss, const uint8_t *pk, const uint8_t *coins);
63+
int pqcrystals_kyber1024_ref_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk);
64+
int pqcrystals_kyber1024_ref_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk);
65+
66+
#endif

‎src/cbd.c

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
#include <stdint.h>
2+
#include "params.h"
3+
#include "cbd.h"
4+
5+
/*************************************************
6+
* Name: load32_littleendian
7+
*
8+
* Description: load 4 bytes into a 32-bit integer
9+
* in little-endian order
10+
*
11+
* Arguments: - const uint8_t *x: pointer to input byte array
12+
*
13+
* Returns 32-bit unsigned integer loaded from x
14+
**************************************************/
15+
static uint32_t load32_littleendian(const uint8_t x[4])
16+
{
17+
uint32_t r;
18+
r = (uint32_t)x[0];
19+
r |= (uint32_t)x[1] << 8;
20+
r |= (uint32_t)x[2] << 16;
21+
r |= (uint32_t)x[3] << 24;
22+
return r;
23+
}
24+
25+
/*************************************************
26+
* Name: load24_littleendian
27+
*
28+
* Description: load 3 bytes into a 32-bit integer
29+
* in little-endian order.
30+
* This function is only needed for Kyber-512
31+
*
32+
* Arguments: - const uint8_t *x: pointer to input byte array
33+
*
34+
* Returns 32-bit unsigned integer loaded from x (most significant byte is zero)
35+
**************************************************/
36+
#if KYBER_ETA1 == 3
37+
static uint32_t load24_littleendian(const uint8_t x[3])
38+
{
39+
uint32_t r;
40+
r = (uint32_t)x[0];
41+
r |= (uint32_t)x[1] << 8;
42+
r |= (uint32_t)x[2] << 16;
43+
return r;
44+
}
45+
#endif
46+
47+
48+
/*************************************************
49+
* Name: cbd2
50+
*
51+
* Description: Given an array of uniformly random bytes, compute
52+
* polynomial with coefficients distributed according to
53+
* a centered binomial distribution with parameter eta=2
54+
*
55+
* Arguments: - poly *r: pointer to output polynomial
56+
* - const uint8_t *buf: pointer to input byte array
57+
**************************************************/
58+
static void cbd2(poly *r, const uint8_t buf[2*KYBER_N/4])
59+
{
60+
unsigned int i,j;
61+
uint32_t t,d;
62+
int16_t a,b;
63+
64+
for(i=0;i<KYBER_N/8;i++) {
65+
t = load32_littleendian(buf+4*i);
66+
d = t & 0x55555555;
67+
d += (t>>1) & 0x55555555;
68+
69+
for(j=0;j<8;j++) {
70+
a = (d >> (4*j+0)) & 0x3;
71+
b = (d >> (4*j+2)) & 0x3;
72+
r->coeffs[8*i+j] = a - b;
73+
}
74+
}
75+
}
76+
77+
/*************************************************
78+
* Name: cbd3
79+
*
80+
* Description: Given an array of uniformly random bytes, compute
81+
* polynomial with coefficients distributed according to
82+
* a centered binomial distribution with parameter eta=3.
83+
* This function is only needed for Kyber-512
84+
*
85+
* Arguments: - poly *r: pointer to output polynomial
86+
* - const uint8_t *buf: pointer to input byte array
87+
**************************************************/
88+
#if KYBER_ETA1 == 3
89+
static void cbd3(poly *r, const uint8_t buf[3*KYBER_N/4])
90+
{
91+
unsigned int i,j;
92+
uint32_t t,d;
93+
int16_t a,b;
94+
95+
for(i=0;i<KYBER_N/4;i++) {
96+
t = load24_littleendian(buf+3*i);
97+
d = t & 0x00249249;
98+
d += (t>>1) & 0x00249249;
99+
d += (t>>2) & 0x00249249;
100+
101+
for(j=0;j<4;j++) {
102+
a = (d >> (6*j+0)) & 0x7;
103+
b = (d >> (6*j+3)) & 0x7;
104+
r->coeffs[4*i+j] = a - b;
105+
}
106+
}
107+
}
108+
#endif
109+
110+
void poly_cbd_eta1(poly *r, const uint8_t buf[KYBER_ETA1*KYBER_N/4])
111+
{
112+
#if KYBER_ETA1 == 2
113+
cbd2(r, buf);
114+
#elif KYBER_ETA1 == 3
115+
cbd3(r, buf);
116+
#else
117+
#error "This implementation requires eta1 in {2,3}"
118+
#endif
119+
}
120+
121+
void poly_cbd_eta2(poly *r, const uint8_t buf[KYBER_ETA2*KYBER_N/4])
122+
{
123+
#if KYBER_ETA2 == 2
124+
cbd2(r, buf);
125+
#else
126+
#error "This implementation requires eta2 = 2"
127+
#endif
128+
}

‎src/cbd.h

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#ifndef CBD_H
2+
#define CBD_H
3+
4+
#include <stdint.h>
5+
#include "params.h"
6+
#include "poly.h"
7+
8+
#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1)
9+
void poly_cbd_eta1(poly *r, const uint8_t buf[KYBER_ETA1*KYBER_N/4]);
10+
11+
#define poly_cbd_eta2 KYBER_NAMESPACE(poly_cbd_eta2)
12+
void poly_cbd_eta2(poly *r, const uint8_t buf[KYBER_ETA2*KYBER_N/4]);
13+
14+
#endif

0 commit comments

Comments
 (0)