test_rudraksh.c

#include "api.h"
#include "cbd.h"
#include "kem.h"
#include "params.h"
#include "poly.h"
#include "polyvec.h"
#include <stdint.h>
#include <stdio.h>
#include <string.h>

#define KEM_ROUNDTRIP_ITERS 512

enum {
    ASSERT_PK_BYTES = 1 / (PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_CRYPTO_PUBLICKEYBYTES == RUDRAKSH_PUBLICKEYBYTES),
    ASSERT_SK_BYTES = 1 / (PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_CRYPTO_SECRETKEYBYTES == RUDRAKSH_SECRETKEYBYTES),
    ASSERT_CT_BYTES = 1 / (PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_CRYPTO_CIPHERTEXTBYTES == RUDRAKSH_CIPHERTEXTBYTES),
    ASSERT_SS_BYTES = 1 / (PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_CRYPTO_BYTES == RUDRAKSH_SSBYTES)
};

static uint32_t rng_state = 0x12345678u;

static uint8_t test_random_byte(void) {
    rng_state ^= rng_state << 13;
    rng_state ^= rng_state >> 17;
    rng_state ^= rng_state << 5;
    return (uint8_t)(rng_state >> 24);
}

static void test_random_bytes(uint8_t *out, size_t outlen) {
    size_t i;

    for (i = 0; i < outlen; i++) {
        out[i] = test_random_byte();
    }
}

static uint16_t test_random_modq(void) {
    uint16_t v = (uint16_t)test_random_byte();

    v = (uint16_t)(v | ((uint16_t)test_random_byte() << 8));
    return (uint16_t)(v % RUDRAKSH_Q);
}

static void test_random_poly(poly *a) {
    unsigned int i;

    for (i = 0; i < RUDRAKSH_N; i++) {
        a->coeffs[i] = (int16_t)test_random_modq();
    }
}

static int poly_equal_modq(const poly *a, const poly *b) {
    unsigned int i;

    for (i = 0; i < RUDRAKSH_N; i++) {
        int16_t x = a->coeffs[i];
        int16_t y = b->coeffs[i];

        while (x < 0) {
            x = (int16_t)(x + RUDRAKSH_Q);
        }
        while (y < 0) {
            y = (int16_t)(y + RUDRAKSH_Q);
        }
        x = (int16_t)(x % RUDRAKSH_Q);
        y = (int16_t)(y % RUDRAKSH_Q);
        if (x != y) {
            return 0;
        }
    }

    return 1;
}

static int test_poly_serialization(void) {
    poly a;
    poly b;
    polyvec av;
    polyvec bv;
    uint8_t buf[RUDRAKSH_POLYBYTES];
    uint8_t vbuf[RUDRAKSH_POLYVECBYTES];
    unsigned int i;

    for (i = 0; i < RUDRAKSH_N; i++) {
        a.coeffs[i] = (int16_t)((i * 127u + 19u) % RUDRAKSH_Q);
    }
    a.coeffs[0] = 0;
    a.coeffs[1] = RUDRAKSH_Q - 1;
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_tobytes(buf, &a);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_frombytes(&b, buf);
    if (!poly_equal_modq(&a, &b)) {
        fprintf(stderr, "poly serialization roundtrip failed\n");
        return 1;
    }

    for (i = 0; i < RUDRAKSH_L; i++) {
        test_random_poly(&av.vec[i]);
    }
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_tobytes(vbuf, &av);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_frombytes(&bv, vbuf);
    for (i = 0; i < RUDRAKSH_L; i++) {
        if (!poly_equal_modq(&av.vec[i], &bv.vec[i])) {
            fprintf(stderr, "polyvec serialization roundtrip failed at component %u\n", i);
            return 1;
        }
    }

    return 0;
}

static int test_compression_normalization(void) {
    poly a;
    poly b;
    polyvec av;
    polyvec bv;
    uint8_t u0[RUDRAKSH_POLYCOMPRESSEDBYTES];
    uint8_t u1[RUDRAKSH_POLYCOMPRESSEDBYTES];
    uint8_t vv0[RUDRAKSH_POLYVCOMPRESSEDBYTES];
    uint8_t vv1[RUDRAKSH_POLYVCOMPRESSEDBYTES];
    uint8_t vu0[RUDRAKSH_POLYVECCOMPRESSEDBYTES];
    uint8_t vu1[RUDRAKSH_POLYVECCOMPRESSEDBYTES];
    unsigned int i;

    for (i = 0; i < 128u; i++) {
        test_random_poly(&a);

        PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_compress_u(u0, &a);
        PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_decompress_u(&b, u0);
        PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_compress_u(u1, &b);
        if (memcmp(u0, u1, sizeof u0) != 0) {
            fprintf(stderr, "u compression normalization failed at iteration %u\n", i);
            return 1;
        }

        PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_compress_v(vv0, &a);
        PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_decompress_v(&b, vv0);
        PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_compress_v(vv1, &b);
        if (memcmp(vv0, vv1, sizeof vv0) != 0) {
            fprintf(stderr, "v compression normalization failed at iteration %u\n", i);
            return 1;
        }
    }

    for (i = 0; i < RUDRAKSH_L; i++) {
        test_random_poly(&av.vec[i]);
    }
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_compress(vu0, &av);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_decompress(&bv, vu0);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_polyvec_compress(vu1, &bv);
    if (memcmp(vu0, vu1, sizeof vu0) != 0) {
        fprintf(stderr, "polyvec compression normalization failed\n");
        return 1;
    }

    return 0;
}

static int test_ntt_roundtrip(void) {
    poly a;
    poly b;
    unsigned int i;

    for (i = 0; i < 128u; i++) {
        test_random_poly(&a);
        b = a;
        PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_ntt(&b);
        PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_invntt(&b);
        if (!poly_equal_modq(&a, &b)) {
            fprintf(stderr, "NTT roundtrip failed at iteration %u\n", i);
            return 1;
        }
    }

    return 0;
}

static int test_message_roundtrip(void) {
    uint8_t msg[RUDRAKSH_MSGBYTES];
    uint8_t out[RUDRAKSH_MSGBYTES];
    poly a;
    unsigned int i;

    for (i = 0; i < 256u; i++) {
        test_random_bytes(msg, sizeof msg);
        PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_frommsg(&a, msg);
        PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_tomsg(out, &a);
        if (memcmp(msg, out, sizeof msg) != 0) {
            fprintf(stderr, "message encode/decode failed at iteration %u\n", i);
            return 1;
        }
    }

    return 0;
}

static int test_cbd_range(void) {
    uint8_t buf[RUDRAKSH_N * 4 / 8];
    poly a;
    unsigned int i;
    unsigned int j;

    for (i = 0; i < 256u; i++) {
        test_random_bytes(buf, sizeof buf);
        PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_poly_cbd_eta2(&a, buf);
        for (j = 0; j < RUDRAKSH_N; j++) {
            if (a.coeffs[j] < -2 || a.coeffs[j] > 2) {
                fprintf(stderr, "CBD coefficient out of range at iteration %u coefficient %u\n", i, j);
                return 1;
            }
        }
    }

    return 0;
}

static int test_derand_determinism(void) {
    uint8_t coins[3u * RUDRAKSH_SYMBYTES];
    uint8_t enc_coins[RUDRAKSH_SYMBYTES];
    uint8_t pk0[RUDRAKSH_PUBLICKEYBYTES];
    uint8_t pk1[RUDRAKSH_PUBLICKEYBYTES];
    uint8_t sk0[RUDRAKSH_SECRETKEYBYTES];
    uint8_t sk1[RUDRAKSH_SECRETKEYBYTES];
    uint8_t ct0[RUDRAKSH_CIPHERTEXTBYTES];
    uint8_t ct1[RUDRAKSH_CIPHERTEXTBYTES];
    uint8_t ss0[RUDRAKSH_SSBYTES];
    uint8_t ss1[RUDRAKSH_SSBYTES];

    test_random_bytes(coins, sizeof coins);
    test_random_bytes(enc_coins, sizeof enc_coins);

    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_crypto_kem_keypair_derand(pk0, sk0, coins);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_crypto_kem_keypair_derand(pk1, sk1, coins);
    if (memcmp(pk0, pk1, sizeof pk0) != 0 || memcmp(sk0, sk1, sizeof sk0) != 0) {
        fprintf(stderr, "keypair_derand is not deterministic\n");
        return 1;
    }

    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_crypto_kem_enc_derand(ct0, ss0, pk0, enc_coins);
    PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_crypto_kem_enc_derand(ct1, ss1, pk0, enc_coins);
    if (memcmp(ct0, ct1, sizeof ct0) != 0 || memcmp(ss0, ss1, sizeof ss0) != 0) {
        fprintf(stderr, "enc_derand is not deterministic\n");
        return 1;
    }

    return 0;
}

static int test_kem_roundtrips(void) {
    uint8_t pk[PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_CRYPTO_PUBLICKEYBYTES];
    uint8_t sk[PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_CRYPTO_SECRETKEYBYTES];
    uint8_t ct[PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_CRYPTO_CIPHERTEXTBYTES];
    uint8_t badct[PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_CRYPTO_CIPHERTEXTBYTES];
    uint8_t ss1[PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_CRYPTO_BYTES];
    uint8_t ss2[PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_CRYPTO_BYTES];
    uint8_t ss3[PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_CRYPTO_BYTES];
    int i;

    for (i = 0; i < KEM_ROUNDTRIP_ITERS; i++) {
        if (PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_crypto_kem_keypair(pk, sk) != 0) {
            return 1;
        }
        if (PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_crypto_kem_enc(ct, ss1, pk) != 0) {
            return 1;
        }
        if (PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_crypto_kem_dec(ss2, ct, sk) != 0) {
            return 1;
        }
        if (memcmp(ss1, ss2, sizeof ss1) != 0) {
            fprintf(stderr, "KEM mismatch at iteration %d\n", i);
            return 1;
        }

        memcpy(badct, ct, sizeof badct);
        badct[(unsigned int)i % sizeof badct] ^= (uint8_t)(1u << ((unsigned int)i & 7u));
        if (PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_crypto_kem_dec(ss3, badct, sk) != 0) {
            return 1;
        }
        if (memcmp(ss1, ss3, sizeof ss1) == 0) {
            fprintf(stderr, "tampered ciphertext accepted at iteration %d\n", i);
            return 1;
        }
    }

    return 0;
}

static int test_ciphertext_tamper_sweep(void) {
    uint8_t pk[RUDRAKSH_PUBLICKEYBYTES];
    uint8_t sk[RUDRAKSH_SECRETKEYBYTES];
    uint8_t ct[RUDRAKSH_CIPHERTEXTBYTES];
    uint8_t badct[RUDRAKSH_CIPHERTEXTBYTES];
    uint8_t ss[RUDRAKSH_SSBYTES];
    uint8_t reject0[RUDRAKSH_SSBYTES];
    uint8_t reject1[RUDRAKSH_SSBYTES];
    size_t i;

    if (PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_crypto_kem_keypair(pk, sk) != 0) {
        return 1;
    }
    if (PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_crypto_kem_enc(ct, ss, pk) != 0) {
        return 1;
    }

    for (i = 0; i < sizeof ct; i++) {
        memcpy(badct, ct, sizeof badct);
        badct[i] ^= (uint8_t)(1u << (i & 7u));
        if (PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_crypto_kem_dec(reject0, badct, sk) != 0) {
            return 1;
        }
        if (PQCLEAN_RUDRAKSHKEMPOLY64_CLEAN_crypto_kem_dec(reject1, badct, sk) != 0) {
            return 1;
        }
        if (memcmp(reject0, reject1, sizeof reject0) != 0) {
            fprintf(stderr, "tampered ciphertext rejection is not deterministic at byte %zu\n", i);
            return 1;
        }
        if (memcmp(ss, reject0, sizeof ss) == 0) {
            fprintf(stderr, "tampered ciphertext accepted at byte %zu\n", i);
            return 1;
        }
    }

    return 0;
}

int main(void) {
    if (test_poly_serialization() != 0 ||
            test_compression_normalization() != 0 ||
            test_ntt_roundtrip() != 0 ||
            test_message_roundtrip() != 0 ||
            test_cbd_range() != 0 ||
            test_derand_determinism() != 0 ||
            test_kem_roundtrips() != 0 ||
            test_ciphertext_tamper_sweep() != 0) {
        return 1;
    }

    puts("Rudraksh KEM-poly64 deep self-test passed");
    return 0;
}