indcpa.c

#include "cbd.h"
#include "indcpa.h"
#include "params.h"
#include "poly.h"
#include "polyvec.h"
#include "symmetric.h"
#include <stdint.h>
#include <string.h>

static void rej_uniform_poly(poly *r, const uint8_t seed[RUDRAKSH_SYMBYTES], uint8_t x, uint8_t y) {
    ascon_xof_state state;
    uint64_t acc = 0;
    unsigned int accbits = 0;
    unsigned int ctr = 0;

    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_xof_absorb_matrix(&state, seed, x, y);

    while (ctr < RUDRAKSH_N) {
        uint16_t val;

        while (accbits < 13u) {
            acc |= (uint64_t)PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_xof_squeeze_byte(&state) << accbits;
            accbits += 8u;
        }

        val = (uint16_t)(acc & 0x1FFFu);
        acc >>= 13;
        accbits -= 13u;

        if (val < RUDRAKSH_Q) {
            r->coeffs[ctr] = (int16_t)val;
            ctr++;
        }
    }
}

static void gen_matrix(poly a[RUDRAKSH_L][RUDRAKSH_L], const uint8_t seed[RUDRAKSH_SYMBYTES], int transposed) {
    unsigned int i;
    unsigned int j;

    for (i = 0; i < RUDRAKSH_L; i++) {
        for (j = 0; j < RUDRAKSH_L; j++) {
            uint8_t x = (uint8_t)(transposed != 0 ? i : j);
            uint8_t y = (uint8_t)(transposed != 0 ? j : i);

            rej_uniform_poly(&a[i][j], seed, x, y);
        }
    }
}

static void sample_noise(poly *r, const uint8_t seed[RUDRAKSH_SYMBYTES], uint8_t nonce) {
    uint8_t buf[RUDRAKSH_N * 4 / 8];

    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_prf(buf, sizeof buf, seed, nonce);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_cbd_eta2(r, buf);
}

static void matrix_vector_mul_hat(polyvec *r, poly a[RUDRAKSH_L][RUDRAKSH_L], const polyvec *v) {
    unsigned int i;

    for (i = 0; i < RUDRAKSH_L; i++) {
        polyvec row;
        unsigned int j;

        for (j = 0; j < RUDRAKSH_L; j++) {
            row.vec[j] = a[i][j];
        }
        PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_pointwise_acc(&r->vec[i], &row, v);
    }
}

static void pack_pk(uint8_t pk[RUDRAKSH_INDCPA_PUBLICKEYBYTES], const polyvec *b, const uint8_t seed[RUDRAKSH_SYMBYTES]) {
    memcpy(pk, seed, RUDRAKSH_SYMBYTES);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_tobytes(pk + RUDRAKSH_SYMBYTES, b);
}

static void unpack_pk(polyvec *b, uint8_t seed[RUDRAKSH_SYMBYTES], const uint8_t pk[RUDRAKSH_INDCPA_PUBLICKEYBYTES]) {
    memcpy(seed, pk, RUDRAKSH_SYMBYTES);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_frombytes(b, pk + RUDRAKSH_SYMBYTES);
}

static void pack_sk(uint8_t sk[RUDRAKSH_INDCPA_SECRETKEYBYTES], const polyvec *s) {
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_tobytes(sk, s);
}

static void unpack_sk(polyvec *s, const uint8_t sk[RUDRAKSH_INDCPA_SECRETKEYBYTES]) {
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_frombytes(s, sk);
}

static void pack_ciphertext(uint8_t c[RUDRAKSH_INDCPA_BYTES], const polyvec *u, const poly *v) {
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_compress(c, u);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_compress_v(c + RUDRAKSH_POLYVECCOMPRESSEDBYTES, v);
}

static void unpack_ciphertext(polyvec *u, poly *v, const uint8_t c[RUDRAKSH_INDCPA_BYTES]) {
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_decompress(u, c);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_decompress_v(v, c + RUDRAKSH_POLYVECCOMPRESSEDBYTES);
}

void PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_indcpa_keypair_derand(uint8_t *pk, uint8_t *sk, const uint8_t *coins) {
    poly a[RUDRAKSH_L][RUDRAKSH_L];
    polyvec s;
    polyvec e;
    polyvec b;
    uint8_t seed_a[RUDRAKSH_SYMBYTES];
    const uint8_t *seed_se = coins + RUDRAKSH_SYMBYTES;
    unsigned int i;

    memcpy(seed_a, coins, RUDRAKSH_SYMBYTES);
    gen_matrix(a, seed_a, 0);

    for (i = 0; i < RUDRAKSH_L; i++) {
        sample_noise(&s.vec[i], seed_se, (uint8_t)i);
        sample_noise(&e.vec[i], seed_se, (uint8_t)(RUDRAKSH_L + i));
    }

    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_ntt(&s);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_ntt(&e);
    matrix_vector_mul_hat(&b, a, &s);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_add(&b, &b, &e);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_reduce(&b);

    pack_pk(pk, &b, seed_a);
    pack_sk(sk, &s);
}

void PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_indcpa_enc(uint8_t *c, const uint8_t *m, const uint8_t *pk, const uint8_t *coins) {
    poly at[RUDRAKSH_L][RUDRAKSH_L];
    polyvec b;
    polyvec sp;
    polyvec ep;
    polyvec u;
    poly v;
    poly k;
    poly epp;
    uint8_t seed_a[RUDRAKSH_SYMBYTES];
    unsigned int i;

    unpack_pk(&b, seed_a, pk);
    gen_matrix(at, seed_a, 1);

    for (i = 0; i < RUDRAKSH_L; i++) {
        sample_noise(&sp.vec[i], coins, (uint8_t)i);
        sample_noise(&ep.vec[i], coins, (uint8_t)(RUDRAKSH_L + i));
    }
    sample_noise(&epp, coins, (uint8_t)(2u * RUDRAKSH_L));

    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_ntt(&sp);

    matrix_vector_mul_hat(&u, at, &sp);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_invntt(&u);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_add(&u, &u, &ep);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_reduce(&u);

    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_pointwise_acc(&v, &b, &sp);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_invntt(&v);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_add(&v, &v, &epp);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_frommsg(&k, m);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_add(&v, &v, &k);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_reduce(&v);

    pack_ciphertext(c, &u, &v);
}

void PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_indcpa_dec(uint8_t *m, const uint8_t *c, const uint8_t *sk) {
    polyvec u;
    polyvec s;
    poly v;
    poly mp;

    unpack_ciphertext(&u, &v, c);
    unpack_sk(&s, sk);

    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_ntt(&u);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_pointwise_acc(&mp, &u, &s);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_invntt(&mp);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_sub(&mp, &v, &mp);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_reduce(&mp);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_tomsg(m, &mp);
}