1
- /* $OpenBSD: sntrup761.c,v 1.5 2021 /01/08 02:33:13 dtucker Exp $ */
1
+ /* $OpenBSD: sntrup761.c,v 1.6 2023 /01/11 02:13:52 djm Exp $ */
2
2
3
3
/*
4
4
* Public Domain, Authors:
@@ -119,7 +119,7 @@ This software is designed to take time independent of x.
119
119
Time still varies depending on m; user must ensure that m is constant.
120
120
Time also varies on CPUs where multiplication is variable-time.
121
121
There could be more CPU issues.
122
- There could also be compiler issues.
122
+ There could also be compiler issues.
123
123
*/
124
124
125
125
static void uint32_divmod_uint14 (uint32 * q ,uint16 * r ,uint32 x ,uint16 m )
@@ -447,7 +447,7 @@ static Fq Fq_freeze(int32 x)
447
447
#ifndef LPR
448
448
449
449
static Fq Fq_recip (Fq a1 )
450
- {
450
+ {
451
451
int i = 1 ;
452
452
Fq ai = a1 ;
453
453
@@ -456,7 +456,7 @@ static Fq Fq_recip(Fq a1)
456
456
i += 1 ;
457
457
}
458
458
return ai ;
459
- }
459
+ }
460
460
461
461
#endif
462
462
@@ -525,47 +525,47 @@ static void R3_mult(small *h,const small *f,const small *g)
525
525
526
526
/* returns 0 if recip succeeded; else -1 */
527
527
static int R3_recip (small * out ,const small * in )
528
- {
528
+ {
529
529
small f [p + 1 ],g [p + 1 ],v [p + 1 ],r [p + 1 ];
530
530
int i ,loop ,delta ;
531
531
int sign ,swap ,t ;
532
-
532
+
533
533
for (i = 0 ;i < p + 1 ;++ i ) v [i ] = 0 ;
534
534
for (i = 0 ;i < p + 1 ;++ i ) r [i ] = 0 ;
535
535
r [0 ] = 1 ;
536
536
for (i = 0 ;i < p ;++ i ) f [i ] = 0 ;
537
537
f [0 ] = 1 ; f [p - 1 ] = f [p ] = -1 ;
538
538
for (i = 0 ;i < p ;++ i ) g [p - 1 - i ] = in [i ];
539
539
g [p ] = 0 ;
540
-
541
- delta = 1 ;
540
+
541
+ delta = 1 ;
542
542
543
543
for (loop = 0 ;loop < 2 * p - 1 ;++ loop ) {
544
544
for (i = p ;i > 0 ;-- i ) v [i ] = v [i - 1 ];
545
545
v [0 ] = 0 ;
546
-
546
+
547
547
sign = - g [0 ]* f [0 ];
548
548
swap = int16_negative_mask (- delta ) & int16_nonzero_mask (g [0 ]);
549
549
delta ^= swap & (delta ^- delta );
550
550
delta += 1 ;
551
-
551
+
552
552
for (i = 0 ;i < p + 1 ;++ i ) {
553
553
t = swap & (f [i ]^g [i ]); f [i ] ^= t ; g [i ] ^= t ;
554
554
t = swap & (v [i ]^r [i ]); v [i ] ^= t ; r [i ] ^= t ;
555
555
}
556
-
556
+
557
557
for (i = 0 ;i < p + 1 ;++ i ) g [i ] = F3_freeze (g [i ]+ sign * f [i ]);
558
558
for (i = 0 ;i < p + 1 ;++ i ) r [i ] = F3_freeze (r [i ]+ sign * v [i ]);
559
559
560
560
for (i = 0 ;i < p ;++ i ) g [i ] = g [i + 1 ];
561
561
g [p ] = 0 ;
562
562
}
563
-
563
+
564
564
sign = f [0 ];
565
565
for (i = 0 ;i < p ;++ i ) out [i ] = sign * v [p - 1 - i ];
566
-
566
+
567
567
return int16_nonzero_mask (delta );
568
- }
568
+ }
569
569
570
570
#endif
571
571
@@ -603,14 +603,14 @@ static void Rq_mult_small(Fq *h,const Fq *f,const small *g)
603
603
static void Rq_mult3 (Fq * h ,const Fq * f )
604
604
{
605
605
int i ;
606
-
606
+
607
607
for (i = 0 ;i < p ;++ i ) h [i ] = Fq_freeze (3 * f [i ]);
608
608
}
609
609
610
610
/* out = 1/(3*in) in Rq */
611
611
/* returns 0 if recip succeeded; else -1 */
612
612
static int Rq_recip3 (Fq * out ,const small * in )
613
- {
613
+ {
614
614
Fq f [p + 1 ],g [p + 1 ],v [p + 1 ],r [p + 1 ];
615
615
int i ,loop ,delta ;
616
616
int swap ,t ;
@@ -739,7 +739,7 @@ static void KeyGen(Fq *h,small *f,small *ginv)
739
739
{
740
740
small g [p ];
741
741
Fq finv [p ];
742
-
742
+
743
743
for (;;) {
744
744
Small_random (g );
745
745
if (R3_recip (ginv ,g ) == 0 ) break ;
@@ -777,7 +777,7 @@ static void Decrypt(small *r,const Fq *c,const small *f,const small *ginv)
777
777
for (i = 0 ;i < w ;++ i ) r [i ] = ((ev [i ]^1 )& ~mask )^1 ;
778
778
for (i = w ;i < p ;++ i ) r [i ] = ev [i ]& ~mask ;
779
779
}
780
-
780
+
781
781
#endif
782
782
783
783
/* ----- NTRU LPRime Core */
@@ -817,7 +817,7 @@ static void Decrypt(int8 *r,const Fq *B,const int8 *T,const small *a)
817
817
for (i = 0 ;i < I ;++ i )
818
818
r [i ] = - int16_negative_mask (Fq_freeze (Right (T [i ])- aB [i ]+ 4 * w + 1 ));
819
819
}
820
-
820
+
821
821
#endif
822
822
823
823
/* ----- encoding I-bit inputs */
@@ -898,7 +898,7 @@ static void HashShort(small *out,const Inputs r)
898
898
}
899
899
900
900
#endif
901
-
901
+
902
902
/* ----- NTRU LPRime Expand */
903
903
904
904
#ifdef LPR
@@ -974,7 +974,7 @@ static void Rq_encode(unsigned char *s,const Fq *r)
974
974
{
975
975
uint16 R [p ],M [p ];
976
976
int i ;
977
-
977
+
978
978
for (i = 0 ;i < p ;++ i ) R [i ] = r [i ]+ q12 ;
979
979
for (i = 0 ;i < p ;++ i ) M [i ] = q ;
980
980
Encode (s ,R ,M ,p );
@@ -989,7 +989,7 @@ static void Rq_decode(Fq *r,const unsigned char *s)
989
989
Decode (R ,s ,M ,p );
990
990
for (i = 0 ;i < p ;++ i ) r [i ] = ((Fq )R [i ])- q12 ;
991
991
}
992
-
992
+
993
993
#endif
994
994
995
995
/* ----- encoding rounded polynomials */
0 commit comments